actions: drop machine-specific replace, document lockfile generator limits

The committed go.mod for the lockfile-extension generator carried an
absolute-path replace directive pointing at a local clone of the private
actions-lockfile repo, which would leak a developer path and break builds
for anyone else. Keep the how-to-test comment but drop the replace line;
local testing uses `go mod edit -replace`.

Also update the two change notes to state that the extractor now generates
the pinnedByLockfileDataModel data into a database-local model pack (applied
via --model-packs), and document the composite-action completeness gap in
the generator README.

Author: nodeselector

actions/extractor/tools/lockfile-extension-generator/README.md

@@ -101,3 +101,16 @@ codeql database analyze <db> \
 
 The lockfile-pinned reference is suppressed; references not covered by the
 lockfile are still reported.
+
+## Limitations
+
+- **Composite actions.** A lockfile records each workflow's *transitive* pin
+  list keyed by the workflow path. A `uses:` that appears only inside a
+  composite action file (`.github/actions/*/action.yml`) is therefore not
+  emitted against that action file's own path, so the query does not suppress
+  it. This is a completeness gap, not a correctness one: it can only leave a
+  reference reported, never wrongly suppress one, because a row is only ever
+  emitted for a `(path, nwo, ref)` the lockfile actually pins.
+- **Ref forms the lockfile can't cover.** Only the resolved ref and its
+  major/major.minor forms are emitted. A `uses:` written with an unrelated tag
+  or a moving branch that the lockfile did not resolve from is not matched.

actions/extractor/tools/lockfile-extension-generator/go.mod

@@ -13,4 +13,5 @@ require gopkg.in/yaml.v3 v3.0.1 // indirect
 //   go mod edit -replace github.com/github/actions-lockfile/go=/path/to/actions-lockfile/go
 //
 // Remove this replace directive once actions-lockfile is published.
+
 replace github.com/github/actions-lockfile/go => /Users/nodeselector/ghq/github.com/github/actions-lockfile/go

actions/ql/lib/change-notes/2026-07-09-pinned-by-lockfile.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* Added a new extensible predicate `pinnedByLockfileDataModel(workflow_path, nwo, ref)`, which records `uses:` references that are pinned by a repository's Actions lockfile (`.github/workflows/actions.lock`). It is intended to be populated by the CodeQL Actions extractor and is currently unpopulated, so it has no effect until that support ships.
+* Added a new extensible predicate `pinnedByLockfileDataModel(workflow_path, nwo, ref)`, which records `uses:` references that are pinned by a repository's Actions lockfile (`.github/workflows/actions.lock`). The CodeQL Actions extractor generates this data at database-creation time into a database-local model pack (`codeql/actions-lockfile-pins`); it has no effect unless that pack is supplied to analysis (for example via `--model-packs`), so behaviour is unchanged for repositories without a lockfile or analyses that do not opt in.

actions/ql/src/change-notes/2026-07-09-unpinned-tag-lockfile-aware.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* The `actions/unpinned-tag` query no longer reports `uses:` references that are recorded as pinned by a repository's Actions lockfile (`.github/workflows/actions.lock`) via the new `pinnedByLockfileDataModel` extensible predicate. This predicate is populated by the CodeQL Actions extractor and has no effect until that support ships.
+* The `actions/unpinned-tag` query no longer reports `uses:` references that are recorded as pinned by a repository's Actions lockfile (`.github/workflows/actions.lock`) via the new `pinnedByLockfileDataModel` extensible predicate. The CodeQL Actions extractor generates this data at database-creation time into a database-local model pack (`codeql/actions-lockfile-pins`); references are suppressed only when that pack is supplied to analysis (for example via `--model-packs`), so behaviour is unchanged for repositories without a lockfile or analyses that do not opt in.