Merge main into feat/csharp-missed-firstordefault-opprtunity

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: baywet

actions/extractor/tools/autobuild-impl.ps1

@@ -9,7 +9,8 @@ $DefaultPathFilters = @(
     'include:.github/reusable_workflows/**/*.yml',
     'include:.github/reusable_workflows/**/*.yaml',
     'include:**/action.yml',
-    'include:**/action.yaml'
+    'include:**/action.yaml',
+    'include:**/actions.lock'
 )
 
 if ($null -ne $env:LGTM_INDEX_FILTERS) {

actions/extractor/tools/autobuild.sh

@@ -14,6 +14,7 @@ include:.github/reusable_workflows/**/*.yml
 include:.github/reusable_workflows/**/*.yaml
 include:**/action.yml
 include:**/action.yaml
+include:**/actions.lock
 END
 )
 

actions/extractor/tools/baseline-config.json

@@ -5,6 +5,7 @@
         ".github/reusable_workflows/**/*.yml",
         ".github/reusable_workflows/**/*.yaml",
         "**/action.yml",
-        "**/action.yaml"
+        "**/action.yaml",
+        "**/actions.lock"
     ]
 }

actions/ql/integration-tests/actions-lock/query/actions.ql

@@ -0,0 +1,4 @@
+import codeql.actions.Lock
+
+from ActionsLock lock
+select lock.getFile()

actions/ql/integration-tests/actions-lock/query/qlpack.yml

@@ -0,0 +1,4 @@
+name: codeql/actions-lock-integration-test
+dependencies:
+  codeql/actions-all: "*"
+warnOnImplicitThis: true

actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml

@@ -0,0 +1,6 @@
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo test

actions/ql/integration-tests/actions-lock/src/actions.lock

@@ -0,0 +1,19 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/test.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+dependencies:
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28':
+        ref: 'v4.37.8'
+        commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+        owner_id: 9919
+        repo_id: 259445878

actions/ql/integration-tests/actions-lock/test.py

@@ -0,0 +1,4 @@
+def test_actions_lock(codeql, actions, javascript):
+    codeql.database.create(source_root="src", language="actions")
+    output = codeql.query.run("query/actions.ql", database="test-db", _capture=True)
+    assert "actions.lock" in output

actions/ql/lib/actions.qll

@@ -1 +1,2 @@
 import codeql.actions.Ast
+import codeql.actions.Lock

actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
+  provides access to their YAML abstract syntax trees.