Add actions.lock extraction

Teach the JavaScript extractor to classify .lock files as YAML while limiting default autobuild extraction to explicitly included paths. Expose Actions lockfiles through the ActionsLock QL class and cover extraction with a normal QL test.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4994bb27-c5ca-47e9-b082-cfc1ca244e86

Author: hvitved

actions/extractor/tools/autobuild-impl.ps1

@@ -9,7 +9,8 @@ $DefaultPathFilters = @(
     'include:.github/reusable_workflows/**/*.yml',
     'include:.github/reusable_workflows/**/*.yaml',
     'include:**/action.yml',
-    'include:**/action.yaml'
+    'include:**/action.yaml',
+    'include:**/actions.lock'
 )
 
 if ($null -ne $env:LGTM_INDEX_FILTERS) {

actions/extractor/tools/autobuild.sh

@@ -14,6 +14,7 @@ include:.github/reusable_workflows/**/*.yml
 include:.github/reusable_workflows/**/*.yaml
 include:**/action.yml
 include:**/action.yaml
+include:**/actions.lock
 END
 )
 

actions/ql/lib/actions.qll

@@ -1 +1,2 @@
 import codeql.actions.Ast
+import codeql.actions.Lock

actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
+  provides access to their YAML abstract syntax trees.

actions/ql/lib/codeql/actions/Lock.qll

@@ -0,0 +1,10 @@
+/**
+ * Provides classes for working with GitHub Actions lockfiles.
+ */
+
+private import codeql.actions.ast.internal.Yaml
+
+/** An `actions.lock` file. */
+class ActionsLock extends YamlDocument {
+  ActionsLock() { this.getFile().getBaseName() = "actions.lock" }
+}

actions/ql/test/library-tests/actions-lock/.github/workflows/test.yml

@@ -0,0 +1,6 @@
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo test

actions/ql/test/library-tests/actions-lock/actions.lock

@@ -0,0 +1,19 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/test.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+dependencies:
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28':
+        ref: 'v4.37.8'
+        commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+        owner_id: 9919
+        repo_id: 259445878

actions/ql/test/library-tests/actions-lock/test.expected

@@ -0,0 +1 @@
+| actions.lock:0:0:0:0 | actions.lock |

actions/ql/test/library-tests/actions-lock/test.ql

@@ -0,0 +1,4 @@
+import codeql.actions.Lock
+
+from ActionsLock lock
+select lock.getFile()

javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java

@@ -404,6 +404,9 @@ private void setupFilters() {
     patterns.add("**/*tsconfig*.json");
     patterns.add("**/codeql-javascript-*.json");
 
+    // exclude lock files that are not explicitly included via `LGTM_INDEX_FILTERS`
+    patterns.add("-**/*.lock");
+
     // include any explicitly specified extensions
     for (String extension : fileTypes.keySet()) patterns.add("**/*" + extension);