Add actions.lock extraction

Teach the JavaScript extractor to classify .lock files as YAML while limiting default autobuild extraction to explicitly included paths. Expose Actions lockfiles through the ActionsLock QL class and cover extraction with a normal QL test.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4994bb27-c5ca-47e9-b082-cfc1ca244e86

Author: hvitved

actions/extractor/tools/autobuild-impl.ps1

@@ -9,7 +9,8 @@ $DefaultPathFilters = @(
     'include:.github/reusable_workflows/**/*.yml',
     'include:.github/reusable_workflows/**/*.yaml',
     'include:**/action.yml',
-    'include:**/action.yaml'
+    'include:**/action.yaml',
+    'include:**/actions.lock'
 )
 
 if ($null -ne $env:LGTM_INDEX_FILTERS) {

actions/extractor/tools/autobuild.sh

@@ -14,6 +14,7 @@ include:.github/reusable_workflows/**/*.yml
 include:.github/reusable_workflows/**/*.yaml
 include:**/action.yml
 include:**/action.yaml
+include:**/actions.lock
 END
 )
 

actions/ql/lib/actions.qll

@@ -1 +1,2 @@
 import codeql.actions.Ast
+import codeql.actions.Lock

actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md

@@ -0,0 +1,10 @@
+/**
+ * Provides classes for working with GitHub Actions lockfiles.
+ */
+
+private import codeql.actions.ast.internal.Yaml
+
+/** An `actions.lock` file. */
+class ActionsLock extends YamlDocument {
+  ActionsLock() { this.getFile().getBaseName() = "actions.lock" }
+}

actions/ql/lib/codeql/actions/Lock.qll

@@ -0,0 +1,6 @@
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo test

actions/ql/test/library-tests/actions-lock/.github/workflows/test.yml

@@ -0,0 +1,19 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/test.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+dependencies:
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28':
+        ref: 'v4.37.8'
+        commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+        owner_id: 9919
+        repo_id: 259445878

actions/ql/test/library-tests/actions-lock/actions.lock

@@ -0,0 +1 @@
+| actions.lock:0:0:0:0 | actions.lock |

actions/ql/test/library-tests/actions-lock/test.expected

@@ -0,0 +1,4 @@
+import codeql.actions.Lock
+
+from ActionsLock lock
+select lock.getFile()

actions/ql/test/library-tests/actions-lock/test.ql

@@ -43,7 +43,7 @@ void good() {
   <li>C++ FAQ: <a href="https://isocpp.org/wiki/faq/exceptions#what-to-throw">
     What should I throw?</a>, <a href="https://isocpp.org/wiki/faq/exceptions#what-to-catch">
     What should I catch?</a>.</li>
-  <li>Wikibooks: <a href="https://en.wikibooks.org/wiki/C%2B%2B_Programming/Exception_Handling#Throwing_objects">
+  <li>Wikibooks: <a href="http://en.wikibooks.org/wiki/C%2B%2B_Programming/Exception_Handling#Throwing_objects">
     Throwing objects</a>.</li>