- name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        config-file: GitHubSecurityLab/CodeQL-Community-Packs/configs/default.yml@main
        config: |
          threat-models: local

Warning: Both a config file and config input were provided. Ignoring config file.

You cannot run the audit config along with local sources via another config (there is no mechanism to append). I would argue that when looking for audit results, local sources would be additional inputs that are warranted. Alternative would be to maintain two configs here otherwise.