The queries were merged into CodeQL repository.
Read more about the research on https://securitylab.github.com/research/github-actions-untrusted-input.