Add actions.lock extraction

Teach the JavaScript extractor to classify .lock files as YAML while limiting default autobuild extraction to explicitly included paths. Expose Actions lockfiles through the ActionsLock QL class and cover extraction with QL and database-creation integration tests.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4994bb27-c5ca-47e9-b082-cfc1ca244e86

Author: hvitved

actions/extractor/tools/autobuild-impl.ps1

@@ -9,7 +9,8 @@ $DefaultPathFilters = @(
     'include:.github/reusable_workflows/**/*.yml',
     'include:.github/reusable_workflows/**/*.yaml',
     'include:**/action.yml',
-    'include:**/action.yaml'
+    'include:**/action.yaml',
+    'include:**/actions.lock'
 )
 
 if ($null -ne $env:LGTM_INDEX_FILTERS) {

actions/extractor/tools/autobuild.sh

@@ -14,6 +14,7 @@ include:.github/reusable_workflows/**/*.yml
 include:.github/reusable_workflows/**/*.yaml
 include:**/action.yml
 include:**/action.yaml
+include:**/actions.lock
 END
 )
 

actions/ql/integration-tests/actions-lock/query/actions.ql

@@ -0,0 +1,4 @@
+import codeql.actions.Lock
+
+from ActionsLock lock
+select lock.getFile()

actions/ql/integration-tests/actions-lock/query/qlpack.yml

@@ -0,0 +1,3 @@
+name: codeql/actions-lock-integration-test
+dependencies:
+  codeql/actions-all: "*"

actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml

@@ -0,0 +1,6 @@
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo test

actions/ql/integration-tests/actions-lock/src/actions.lock

@@ -0,0 +1,19 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/test.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+dependencies:
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28':
+        ref: 'v4.37.8'
+        commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+        owner_id: 9919
+        repo_id: 259445878

actions/ql/integration-tests/actions-lock/test.py

@@ -0,0 +1,4 @@
+def test_actions_lock(codeql, actions, javascript):
+    codeql.database.create(source_root="src", language="actions")
+    output = codeql.query.run("query/actions.ql", database="test-db", _capture=True)
+    assert "actions.lock" in output

actions/ql/lib/actions.qll

@@ -1 +1,2 @@
 import codeql.actions.Ast
+import codeql.actions.Lock

actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
+  provides access to their YAML abstract syntax trees.

actions/ql/lib/codeql/actions/Lock.qll

@@ -0,0 +1,10 @@
+/**
+ * Provides classes for working with GitHub Actions lockfiles.
+ */
+
+private import codeql.actions.ast.internal.Yaml
+
+/** An `actions.lock` file. */
+class ActionsLock extends YamlDocument {
+  ActionsLock() { this.getFile().getBaseName() = "actions.lock" }
+}