diff --git a/actions/extractor/tools/autobuild-impl.ps1 b/actions/extractor/tools/autobuild-impl.ps1 index e232cd3cc545..6f04a28520d3 100644 --- a/actions/extractor/tools/autobuild-impl.ps1 +++ b/actions/extractor/tools/autobuild-impl.ps1 @@ -9,7 +9,8 @@ $DefaultPathFilters = @( 'include:.github/reusable_workflows/**/*.yml', 'include:.github/reusable_workflows/**/*.yaml', 'include:**/action.yml', - 'include:**/action.yaml' + 'include:**/action.yaml', + 'include:**/actions.lock' ) if ($null -ne $env:LGTM_INDEX_FILTERS) { diff --git a/actions/extractor/tools/autobuild.sh b/actions/extractor/tools/autobuild.sh index f2cbb7ddfa7e..c2794044ee64 100755 --- a/actions/extractor/tools/autobuild.sh +++ b/actions/extractor/tools/autobuild.sh @@ -14,6 +14,7 @@ include:.github/reusable_workflows/**/*.yml include:.github/reusable_workflows/**/*.yaml include:**/action.yml include:**/action.yaml +include:**/actions.lock END ) diff --git a/actions/extractor/tools/baseline-config.json b/actions/extractor/tools/baseline-config.json index fde0bd1ecdff..5c0044c8d9d8 100644 --- a/actions/extractor/tools/baseline-config.json +++ b/actions/extractor/tools/baseline-config.json @@ -5,6 +5,7 @@ ".github/reusable_workflows/**/*.yml", ".github/reusable_workflows/**/*.yaml", "**/action.yml", - "**/action.yaml" + "**/action.yaml", + "**/actions.lock" ] } diff --git a/actions/ql/integration-tests/actions-lock/query/actions.ql b/actions/ql/integration-tests/actions-lock/query/actions.ql new file mode 100644 index 000000000000..03451f476fcd --- /dev/null +++ b/actions/ql/integration-tests/actions-lock/query/actions.ql @@ -0,0 +1,4 @@ +import codeql.actions.Lock + +from ActionsLock lock +select lock.getFile() diff --git a/actions/ql/integration-tests/actions-lock/query/qlpack.yml b/actions/ql/integration-tests/actions-lock/query/qlpack.yml new file mode 100644 index 000000000000..03c0b4e9a3af --- /dev/null +++ b/actions/ql/integration-tests/actions-lock/query/qlpack.yml @@ -0,0 +1,4 @@ +name: codeql/actions-lock-integration-test +dependencies: + codeql/actions-all: "*" +warnOnImplicitThis: true diff --git a/actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml b/actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml new file mode 100644 index 000000000000..79afdcdf7006 --- /dev/null +++ b/actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml @@ -0,0 +1,6 @@ +on: push +jobs: + test: + runs-on: ubuntu-latest + steps: + - run: echo test diff --git a/actions/ql/integration-tests/actions-lock/src/actions.lock b/actions/ql/integration-tests/actions-lock/src/actions.lock new file mode 100644 index 000000000000..bb91aa093d86 --- /dev/null +++ b/actions/ql/integration-tests/actions-lock/src/actions.lock @@ -0,0 +1,19 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/test.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' +dependencies: + 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': + ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28': + ref: 'v4.37.8' + commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' + owner_id: 9919 + repo_id: 259445878 diff --git a/actions/ql/integration-tests/actions-lock/test.py b/actions/ql/integration-tests/actions-lock/test.py new file mode 100644 index 000000000000..3d63143dc1c2 --- /dev/null +++ b/actions/ql/integration-tests/actions-lock/test.py @@ -0,0 +1,4 @@ +def test_actions_lock(codeql, actions, javascript): + codeql.database.create(source_root="src", language="actions") + output = codeql.query.run("query/actions.ql", database="test-db", _capture=True) + assert "actions.lock" in output diff --git a/actions/ql/lib/actions.qll b/actions/ql/lib/actions.qll index 2c1d1cee9259..f57127b0f031 100644 --- a/actions/ql/lib/actions.qll +++ b/actions/ql/lib/actions.qll @@ -1 +1,2 @@ import codeql.actions.Ast +import codeql.actions.Lock diff --git a/actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md b/actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md new file mode 100644 index 000000000000..ed0a25515da0 --- /dev/null +++ b/actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md @@ -0,0 +1,5 @@ +--- +category: feature +--- +* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class + provides access to their YAML abstract syntax trees. diff --git a/actions/ql/lib/codeql/actions/Lock.qll b/actions/ql/lib/codeql/actions/Lock.qll new file mode 100644 index 000000000000..8fb8a8a8b359 --- /dev/null +++ b/actions/ql/lib/codeql/actions/Lock.qll @@ -0,0 +1,10 @@ +/** + * Provides classes for working with GitHub Actions lockfiles. + */ + +private import codeql.actions.ast.internal.Yaml + +/** An `actions.lock` file. */ +class ActionsLock extends YamlDocument { + ActionsLock() { this.getFile().getBaseName() = "actions.lock" } +} diff --git a/actions/ql/test/library-tests/actions-lock/.github/workflows/test.yml b/actions/ql/test/library-tests/actions-lock/.github/workflows/test.yml new file mode 100644 index 000000000000..79afdcdf7006 --- /dev/null +++ b/actions/ql/test/library-tests/actions-lock/.github/workflows/test.yml @@ -0,0 +1,6 @@ +on: push +jobs: + test: + runs-on: ubuntu-latest + steps: + - run: echo test diff --git a/actions/ql/test/library-tests/actions-lock/actions.lock b/actions/ql/test/library-tests/actions-lock/actions.lock new file mode 100644 index 000000000000..bb91aa093d86 --- /dev/null +++ b/actions/ql/test/library-tests/actions-lock/actions.lock @@ -0,0 +1,19 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/test.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' +dependencies: + 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': + ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28': + ref: 'v4.37.8' + commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' + owner_id: 9919 + repo_id: 259445878 diff --git a/actions/ql/test/library-tests/actions-lock/options b/actions/ql/test/library-tests/actions-lock/options new file mode 100644 index 000000000000..fa6fe3a34854 --- /dev/null +++ b/actions/ql/test/library-tests/actions-lock/options @@ -0,0 +1 @@ +semmle-extractor-options: actions.lock diff --git a/actions/ql/test/library-tests/actions-lock/test.expected b/actions/ql/test/library-tests/actions-lock/test.expected new file mode 100644 index 000000000000..128df0e9ae0e --- /dev/null +++ b/actions/ql/test/library-tests/actions-lock/test.expected @@ -0,0 +1 @@ +| actions.lock:0:0:0:0 | actions.lock | diff --git a/actions/ql/test/library-tests/actions-lock/test.ql b/actions/ql/test/library-tests/actions-lock/test.ql new file mode 100644 index 000000000000..03451f476fcd --- /dev/null +++ b/actions/ql/test/library-tests/actions-lock/test.ql @@ -0,0 +1,4 @@ +import codeql.actions.Lock + +from ActionsLock lock +select lock.getFile() diff --git a/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java b/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java index d88897819211..b6cdfa44a7db 100644 --- a/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java +++ b/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java @@ -404,6 +404,9 @@ private void setupFilters() { patterns.add("**/*tsconfig*.json"); patterns.add("**/codeql-javascript-*.json"); + // exclude lock files that are not explicitly included via `LGTM_INDEX_FILTERS` + patterns.add("-**/*.lock"); + // include any explicitly specified extensions for (String extension : fileTypes.keySet()) patterns.add("**/*" + extension); diff --git a/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java index 70d6677855d5..5247b2e506ef 100644 --- a/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java +++ b/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java @@ -321,7 +321,7 @@ public boolean isTrapCachingAllowed() { } }, - YAML(".raml", ".yaml", ".yml") { + YAML(".lock", ".raml", ".yaml", ".yml") { @Override public IExtractor mkExtractor(ExtractorConfig config, ExtractorState state) { return new YAMLExtractor(config);