Limit lockfile extraction to configured paths

Exclude lockfiles from JavaScript's default autobuild set so only explicitly included files such as Actions actions.lock are extracted. Ensure QL tests pass the lockfile to the extractor.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4994bb27-c5ca-47e9-b082-cfc1ca244e86

Author: hvitved

actions/ql/test/library-tests/actions-lock/options

@@ -0,0 +1 @@
+semmle-extractor-options: actions.lock

javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java

@@ -155,7 +155,7 @@
  *   <li>All HTML files, that is, files with with one of the extensions supported by {@link
  *       FileType#HTML} (currently ".htm", ".html", ".xhtm", ".xhtml", ".vue", ".html.erb", ".html.dot", ".jsp").
  *   <li>All YAML files, that is, files with one of the extensions supported by {@link
- *       FileType#YAML} (currently ".lock", ".raml", ".yaml", ".yml").
+ *       FileType#YAML} (currently ".raml", ".yaml", ".yml").
  *   <li>Files with base name "package.json" or "tsconfig.json", and files whose base name
  *       is of the form "codeql-javascript-*.json".
  *   <li>JavaScript, JSON or YAML files whose base name starts with ".eslintrc".
@@ -404,6 +404,9 @@ private void setupFilters() {
     patterns.add("**/*tsconfig*.json");
     patterns.add("**/codeql-javascript-*.json");
 
+    // exclude lock files that are not explicitly included via `LGTM_INDEX_FILTERS`
+    patterns.add("-**/*.lock");
+
     // include any explicitly specified extensions
     for (String extension : fileTypes.keySet()) patterns.add("**/*" + extension);
 

javascript/resources/codeql-extractor.yml

@@ -66,7 +66,6 @@ file_types:
     display_name: Data or configuration files
     extensions:
       - .json
-      - .lock
       - .yml
       - .yaml
       - .raml