Add actions.lock extraction

actions/extractor/tools/autobuild-impl.ps1

@@ -9,7 +9,8 @@ $DefaultPathFilters = @(
     'include:.github/reusable_workflows/**/*.yml',
     'include:.github/reusable_workflows/**/*.yaml',
     'include:**/action.yml',
-    'include:**/action.yaml'
+    'include:**/action.yaml',
+    'include:**/actions.lock'
 )
 
 if ($null -ne $env:LGTM_INDEX_FILTERS) {

actions/extractor/tools/autobuild.sh

@@ -14,6 +14,7 @@ include:.github/reusable_workflows/**/*.yml
 include:.github/reusable_workflows/**/*.yaml
 include:**/action.yml
 include:**/action.yaml
+include:**/actions.lock
 END
 )
 

actions/extractor/tools/baseline-config.json

@@ -5,6 +5,7 @@
         ".github/reusable_workflows/**/*.yml",
         ".github/reusable_workflows/**/*.yaml",
         "**/action.yml",
-        "**/action.yaml"
+        "**/action.yaml",
+        "**/actions.lock"
     ]
 }

actions/ql/integration-tests/actions-lock/query/actions.ql

@@ -0,0 +1,4 @@
+import codeql.actions.Lock
+
+from ActionsLock lock
+select lock.getFile()

actions/ql/integration-tests/actions-lock/query/qlpack.yml

@@ -0,0 +1,4 @@
+name: codeql/actions-lock-integration-test
+dependencies:
+  codeql/actions-all: "*"
+warnOnImplicitThis: true

actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml

@@ -0,0 +1,6 @@
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo test

actions/ql/integration-tests/actions-lock/src/actions.lock

@@ -0,0 +1,19 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/test.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+dependencies:
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28':
+        ref: 'v4.37.8'
+        commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+        owner_id: 9919
+        repo_id: 259445878

actions/ql/integration-tests/actions-lock/test.py

@@ -0,0 +1,4 @@
+def test_actions_lock(codeql, actions, javascript):
+    codeql.database.create(source_root="src", language="actions")
+    output = codeql.query.run("query/actions.ql", database="test-db", _capture=True)
+    assert "actions.lock" in output

actions/ql/lib/actions.qll

@@ -1 +1,2 @@
 import codeql.actions.Ast
+import codeql.actions.Lock

actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
+  provides access to their YAML abstract syntax trees.

actions/ql/lib/codeql/actions/Lock.qll

@@ -0,0 +1,10 @@
+/**
+ * Provides classes for working with GitHub Actions lockfiles.
+ */
+
+private import codeql.actions.ast.internal.Yaml
+
+/** An `actions.lock` file. */
+class ActionsLock extends YamlDocument {
+  ActionsLock() { this.getFile().getBaseName() = "actions.lock" }
+}

actions/ql/test/library-tests/actions-lock/.github/workflows/test.yml

@@ -0,0 +1,6 @@
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo test

actions/ql/test/library-tests/actions-lock/actions.lock

@@ -0,0 +1,19 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/test.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+dependencies:
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28':
+        ref: 'v4.37.8'
+        commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+        owner_id: 9919
+        repo_id: 259445878

actions/ql/test/library-tests/actions-lock/options

@@ -0,0 +1 @@
+semmle-extractor-options: actions.lock

actions/ql/test/library-tests/actions-lock/test.expected

@@ -0,0 +1 @@
+| actions.lock:0:0:0:0 | actions.lock |

actions/ql/test/library-tests/actions-lock/test.ql

@@ -0,0 +1,4 @@
+import codeql.actions.Lock
+
+from ActionsLock lock
+select lock.getFile()

javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java

@@ -404,6 +404,9 @@ private void setupFilters() {
     patterns.add("**/*tsconfig*.json");
     patterns.add("**/codeql-javascript-*.json");
 
+    // exclude lock files that are not explicitly included via `LGTM_INDEX_FILTERS`
+    patterns.add("-**/*.lock");
+
     // include any explicitly specified extensions
     for (String extension : fileTypes.keySet()) patterns.add("**/*" + extension);
 

javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java

@@ -321,7 +321,7 @@ public boolean isTrapCachingAllowed() {
       }
     },
 
-    YAML(".raml", ".yaml", ".yml") {
+    YAML(".lock", ".raml", ".yaml", ".yml") {
       @Override
       public IExtractor mkExtractor(ExtractorConfig config, ExtractorState state) {
         return new YAMLExtractor(config);