From 23772149ca0fc2b3d35f0a5b6a431797daf85c88 Mon Sep 17 00:00:00 2001 From: Tom Hvitved Date: Wed, 2 Sep 2026 10:32:49 +0200 Subject: [PATCH 1/2] Add actions.lock extraction Teach the JavaScript extractor to classify .lock files as YAML while limiting default autobuild extraction to explicitly included paths. Expose Actions lockfiles through the ActionsLock QL class and cover extraction with QL and database-creation integration tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4994bb27-c5ca-47e9-b082-cfc1ca244e86 --- actions/extractor/tools/autobuild-impl.ps1 | 3 ++- actions/extractor/tools/autobuild.sh | 1 + .../actions-lock/query/actions.ql | 4 ++++ .../actions-lock/query/qlpack.yml | 4 ++++ .../src/.github/workflows/test.yml | 6 ++++++ .../actions-lock/src/actions.lock | 19 +++++++++++++++++++ .../ql/integration-tests/actions-lock/test.py | 4 ++++ actions/ql/lib/actions.qll | 1 + .../2026-09-01-actions-lock-yaml.md | 5 +++++ actions/ql/lib/codeql/actions/Lock.qll | 10 ++++++++++ .../actions-lock/.github/workflows/test.yml | 6 ++++++ .../library-tests/actions-lock/actions.lock | 19 +++++++++++++++++++ .../test/library-tests/actions-lock/options | 1 + .../library-tests/actions-lock/test.expected | 1 + .../test/library-tests/actions-lock/test.ql | 4 ++++ .../com/semmle/js/extractor/AutoBuild.java | 3 +++ .../semmle/js/extractor/FileExtractor.java | 2 +- 17 files changed, 91 insertions(+), 2 deletions(-) create mode 100644 actions/ql/integration-tests/actions-lock/query/actions.ql create mode 100644 actions/ql/integration-tests/actions-lock/query/qlpack.yml create mode 100644 actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml create mode 100644 actions/ql/integration-tests/actions-lock/src/actions.lock create mode 100644 actions/ql/integration-tests/actions-lock/test.py create mode 100644 actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md create mode 100644 actions/ql/lib/codeql/actions/Lock.qll create mode 100644 actions/ql/test/library-tests/actions-lock/.github/workflows/test.yml create mode 100644 actions/ql/test/library-tests/actions-lock/actions.lock create mode 100644 actions/ql/test/library-tests/actions-lock/options create mode 100644 actions/ql/test/library-tests/actions-lock/test.expected create mode 100644 actions/ql/test/library-tests/actions-lock/test.ql diff --git a/actions/extractor/tools/autobuild-impl.ps1 b/actions/extractor/tools/autobuild-impl.ps1 index e232cd3cc545..6f04a28520d3 100644 --- a/actions/extractor/tools/autobuild-impl.ps1 +++ b/actions/extractor/tools/autobuild-impl.ps1 @@ -9,7 +9,8 @@ $DefaultPathFilters = @( 'include:.github/reusable_workflows/**/*.yml', 'include:.github/reusable_workflows/**/*.yaml', 'include:**/action.yml', - 'include:**/action.yaml' + 'include:**/action.yaml', + 'include:**/actions.lock' ) if ($null -ne $env:LGTM_INDEX_FILTERS) { diff --git a/actions/extractor/tools/autobuild.sh b/actions/extractor/tools/autobuild.sh index f2cbb7ddfa7e..c2794044ee64 100755 --- a/actions/extractor/tools/autobuild.sh +++ b/actions/extractor/tools/autobuild.sh @@ -14,6 +14,7 @@ include:.github/reusable_workflows/**/*.yml include:.github/reusable_workflows/**/*.yaml include:**/action.yml include:**/action.yaml +include:**/actions.lock END ) diff --git a/actions/ql/integration-tests/actions-lock/query/actions.ql b/actions/ql/integration-tests/actions-lock/query/actions.ql new file mode 100644 index 000000000000..03451f476fcd --- /dev/null +++ b/actions/ql/integration-tests/actions-lock/query/actions.ql @@ -0,0 +1,4 @@ +import codeql.actions.Lock + +from ActionsLock lock +select lock.getFile() diff --git a/actions/ql/integration-tests/actions-lock/query/qlpack.yml b/actions/ql/integration-tests/actions-lock/query/qlpack.yml new file mode 100644 index 000000000000..03c0b4e9a3af --- /dev/null +++ b/actions/ql/integration-tests/actions-lock/query/qlpack.yml @@ -0,0 +1,4 @@ +name: codeql/actions-lock-integration-test +dependencies: + codeql/actions-all: "*" +warnOnImplicitThis: true diff --git a/actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml b/actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml new file mode 100644 index 000000000000..79afdcdf7006 --- /dev/null +++ b/actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml @@ -0,0 +1,6 @@ +on: push +jobs: + test: + runs-on: ubuntu-latest + steps: + - run: echo test diff --git a/actions/ql/integration-tests/actions-lock/src/actions.lock b/actions/ql/integration-tests/actions-lock/src/actions.lock new file mode 100644 index 000000000000..bb91aa093d86 --- /dev/null +++ b/actions/ql/integration-tests/actions-lock/src/actions.lock @@ -0,0 +1,19 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/test.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' +dependencies: + 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': + ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28': + ref: 'v4.37.8' + commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' + owner_id: 9919 + repo_id: 259445878 diff --git a/actions/ql/integration-tests/actions-lock/test.py b/actions/ql/integration-tests/actions-lock/test.py new file mode 100644 index 000000000000..3d63143dc1c2 --- /dev/null +++ b/actions/ql/integration-tests/actions-lock/test.py @@ -0,0 +1,4 @@ +def test_actions_lock(codeql, actions, javascript): + codeql.database.create(source_root="src", language="actions") + output = codeql.query.run("query/actions.ql", database="test-db", _capture=True) + assert "actions.lock" in output diff --git a/actions/ql/lib/actions.qll b/actions/ql/lib/actions.qll index 2c1d1cee9259..f57127b0f031 100644 --- a/actions/ql/lib/actions.qll +++ b/actions/ql/lib/actions.qll @@ -1 +1,2 @@ import codeql.actions.Ast +import codeql.actions.Lock diff --git a/actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md b/actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md new file mode 100644 index 000000000000..ed0a25515da0 --- /dev/null +++ b/actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md @@ -0,0 +1,5 @@ +--- +category: feature +--- +* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class + provides access to their YAML abstract syntax trees. diff --git a/actions/ql/lib/codeql/actions/Lock.qll b/actions/ql/lib/codeql/actions/Lock.qll new file mode 100644 index 000000000000..8fb8a8a8b359 --- /dev/null +++ b/actions/ql/lib/codeql/actions/Lock.qll @@ -0,0 +1,10 @@ +/** + * Provides classes for working with GitHub Actions lockfiles. + */ + +private import codeql.actions.ast.internal.Yaml + +/** An `actions.lock` file. */ +class ActionsLock extends YamlDocument { + ActionsLock() { this.getFile().getBaseName() = "actions.lock" } +} diff --git a/actions/ql/test/library-tests/actions-lock/.github/workflows/test.yml b/actions/ql/test/library-tests/actions-lock/.github/workflows/test.yml new file mode 100644 index 000000000000..79afdcdf7006 --- /dev/null +++ b/actions/ql/test/library-tests/actions-lock/.github/workflows/test.yml @@ -0,0 +1,6 @@ +on: push +jobs: + test: + runs-on: ubuntu-latest + steps: + - run: echo test diff --git a/actions/ql/test/library-tests/actions-lock/actions.lock b/actions/ql/test/library-tests/actions-lock/actions.lock new file mode 100644 index 000000000000..bb91aa093d86 --- /dev/null +++ b/actions/ql/test/library-tests/actions-lock/actions.lock @@ -0,0 +1,19 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/test.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' +dependencies: + 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': + ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28': + ref: 'v4.37.8' + commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' + owner_id: 9919 + repo_id: 259445878 diff --git a/actions/ql/test/library-tests/actions-lock/options b/actions/ql/test/library-tests/actions-lock/options new file mode 100644 index 000000000000..fa6fe3a34854 --- /dev/null +++ b/actions/ql/test/library-tests/actions-lock/options @@ -0,0 +1 @@ +semmle-extractor-options: actions.lock diff --git a/actions/ql/test/library-tests/actions-lock/test.expected b/actions/ql/test/library-tests/actions-lock/test.expected new file mode 100644 index 000000000000..128df0e9ae0e --- /dev/null +++ b/actions/ql/test/library-tests/actions-lock/test.expected @@ -0,0 +1 @@ +| actions.lock:0:0:0:0 | actions.lock | diff --git a/actions/ql/test/library-tests/actions-lock/test.ql b/actions/ql/test/library-tests/actions-lock/test.ql new file mode 100644 index 000000000000..03451f476fcd --- /dev/null +++ b/actions/ql/test/library-tests/actions-lock/test.ql @@ -0,0 +1,4 @@ +import codeql.actions.Lock + +from ActionsLock lock +select lock.getFile() diff --git a/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java b/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java index d88897819211..b6cdfa44a7db 100644 --- a/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java +++ b/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java @@ -404,6 +404,9 @@ private void setupFilters() { patterns.add("**/*tsconfig*.json"); patterns.add("**/codeql-javascript-*.json"); + // exclude lock files that are not explicitly included via `LGTM_INDEX_FILTERS` + patterns.add("-**/*.lock"); + // include any explicitly specified extensions for (String extension : fileTypes.keySet()) patterns.add("**/*" + extension); diff --git a/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java index 70d6677855d5..5247b2e506ef 100644 --- a/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java +++ b/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java @@ -321,7 +321,7 @@ public boolean isTrapCachingAllowed() { } }, - YAML(".raml", ".yaml", ".yml") { + YAML(".lock", ".raml", ".yaml", ".yml") { @Override public IExtractor mkExtractor(ExtractorConfig config, ExtractorState state) { return new YAMLExtractor(config); From 71029990432e5f3ecca846ee8bf8fe99e5c91dac Mon Sep 17 00:00:00 2001 From: Tom Hvitved Date: Wed, 2 Sep 2026 14:12:21 +0200 Subject: [PATCH 2/2] Include actions.lock in baseline paths Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- actions/extractor/tools/baseline-config.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/actions/extractor/tools/baseline-config.json b/actions/extractor/tools/baseline-config.json index fde0bd1ecdff..5c0044c8d9d8 100644 --- a/actions/extractor/tools/baseline-config.json +++ b/actions/extractor/tools/baseline-config.json @@ -5,6 +5,7 @@ ".github/reusable_workflows/**/*.yml", ".github/reusable_workflows/**/*.yaml", "**/action.yml", - "**/action.yaml" + "**/action.yaml", + "**/actions.lock" ] }