Potential fix for code scanning alert no. 208: Checkout of untrusted code in trusted context (#345)

Potential fix for
[https://github.com/langchain-ai/langchain-mongodb/security/code-scanning/208](https://github.com/langchain-ai/langchain-mongodb/security/code-scanning/208)

General approach: when a workflow is reusable (`workflow_call`) and you
allow the caller to pass a `ref` used in `actions/checkout`, you must
ensure that the ref cannot point to arbitrary untrusted pull-request
code in a privileged context. This can be done either by removing the
ability to override the ref, or by validating/constraining it to trusted
refs (e.g., `main`, release tags) or to the ref of the current trusted
event.

Best minimally invasive fix here: stop using the externally supplied
`inputs.ref` for checkout in this workflow, and instead use the ref
associated with the current run (`github.sha`), which is safe for
`push`, `pull_request`, and `schedule`, and for `workflow_call` callers
that simply want to analyze the same commit they’re running on. This
removes the untrusted parameter from the checkout without changing the
functional behavior for normal, non-abusive usage (the workflow will
still run CodeQL on the commit that triggered or called the workflow).

Concretely, in `.github/workflows/codeql.yml`, update the checkout step
so that:

- `ref: ${{ inputs.ref }}` is replaced with `ref: ${{ github.sha }}`.
- Leave the rest of the workflow unchanged.

This avoids unsafe arbitrary refs while preserving intended CodeQL
analysis behavior.

---


_Suggested fixes powered by Copilot Autofix. Review carefully before
merging._

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>