actions: generate lockfile-pinned data extension during extraction

Wire the lockfile-extension-generator into the Actions extractor autobuild so
that codeql database create automatically emits the pinnedByLockfileDataModel
data extension from a repository's .github/workflows/actions.lock. The extension
is written into the database as a self-contained model pack under
<db>/lockfile-extension (codeql/actions-lockfile-pins).

A new generate-lockfile-extension.sh runs after JS extraction: it locates the
lockfile relative to the captured source root, resolves the generator (prebuilt
binary if shipped, else builds from source when a Go toolchain is present), and
writes the pack. It is a clean no-op when the repository has no lockfile, so it
is safe to run against every database.

CodeQL does not auto-apply extensions carried inside a database, so analysis
still adds the pack explicitly via --model-packs codeql/actions-lockfile-pins
(--additional-packs <db>/lockfile-extension). Wiring that into the analysis
harness is the remaining step and lives outside this repo.

Verified end to end locally by overlaying the modified extractor into the CLI
bundle: database create emits the extension, and analyze suppresses a
lockfile-pinned short-tag ref (uses: owner/action@v4 resolved to v4.3.1) while
still reporting refs not covered by the lockfile.

Author: nodeselector

actions/extractor/tools/autobuild.sh

@@ -37,6 +37,11 @@ else
     export LGTM_INDEX_FILTERS
 fi
 
+# Capture the source root before handing off to the JavaScript autobuilder,
+# which may change the working directory. The Actions extractor runs from the
+# source root, so `pwd` here is the root of the repository being analysed.
+ACTIONS_SRC_ROOT="$(pwd)"
+
 # Find the JavaScript extractor directory via `codeql resolve extractor`.
 CODEQL_EXTRACTOR_JAVASCRIPT_ROOT="$("${CODEQL_DIST}/codeql" resolve extractor --language javascript)"
 export CODEQL_EXTRACTOR_JAVASCRIPT_ROOT
@@ -55,3 +60,12 @@ env CODEQL_EXTRACTOR_JAVASCRIPT_DIAGNOSTIC_DIR="${CODEQL_EXTRACTOR_ACTIONS_DIAGN
     CODEQL_EXTRACTOR_JAVASCRIPT_TRAP_DIR="${CODEQL_EXTRACTOR_ACTIONS_TRAP_DIR}" \
     CODEQL_EXTRACTOR_JAVASCRIPT_WIP_DATABASE="${CODEQL_EXTRACTOR_ACTIONS_WIP_DATABASE}" \
     "${JAVASCRIPT_AUTO_BUILD}"
+
+# Generate the lockfile-pinned data extension from the repository's Actions
+# lockfile, if present. This is a no-op for repositories without a lockfile.
+GENERATE_LOCKFILE_EXTENSION="$(CDPATH= cd "$(dirname "$0")" && pwd)/generate-lockfile-extension.sh"
+if [ -x "${GENERATE_LOCKFILE_EXTENSION}" ]; then
+    echo "Generating lockfile-pinned data extension."
+    "${GENERATE_LOCKFILE_EXTENSION}" "${ACTIONS_SRC_ROOT}" || \
+        echo "Lockfile-pinned data extension generation failed; continuing without it." >&2
+fi

actions/extractor/tools/generate-lockfile-extension.sh

@@ -0,0 +1,80 @@
+#!/bin/sh
+
+# Generates a CodeQL data extension that records the `uses:` references pinned by
+# the repository's GitHub Actions lockfile (`.github/workflows/actions.lock`),
+# populating the `pinnedByLockfileDataModel` extensible predicate consumed by the
+# `actions/unpinned-tag` query.
+#
+# It is invoked by the Actions extractor autobuild during `codeql database
+# create`. The generated extension is written into the database as a
+# self-contained model pack under:
+#
+#   <database>/lockfile-extension/
+#     qlpack.yml
+#     ext/pinned_by_lockfile.model.yml
+#
+# CodeQL does not auto-apply extensions carried inside a database, so analysis
+# must add this pack explicitly, e.g.:
+#
+#   codeql database analyze <db> ... \
+#     --additional-packs <db>/lockfile-extension \
+#     --model-packs codeql/actions-lockfile-pins
+#
+# The step is a clean no-op when the repository has no lockfile, so it is safe to
+# run against every database.
+
+set -eu
+
+SRC_ROOT="${1:?usage: generate-lockfile-extension.sh <source-root>}"
+LOCKFILE="${SRC_ROOT}/.github/workflows/actions.lock"
+
+if [ ! -f "${LOCKFILE}" ]; then
+    echo "No Actions lockfile at '${LOCKFILE}'; skipping lockfile-pinned extension."
+    exit 0
+fi
+
+if [ -z "${CODEQL_EXTRACTOR_ACTIONS_WIP_DATABASE:-}" ]; then
+    echo "CODEQL_EXTRACTOR_ACTIONS_WIP_DATABASE is not set; cannot write lockfile extension." >&2
+    exit 0
+fi
+
+SCRIPT_DIR="$(CDPATH= cd "$(dirname "$0")" && pwd)"
+GEN_DIR="${SCRIPT_DIR}/lockfile-extension-generator"
+
+PACK_DIR="${CODEQL_EXTRACTOR_ACTIONS_WIP_DATABASE}/lockfile-extension"
+EXT_DIR="${PACK_DIR}/ext"
+mkdir -p "${EXT_DIR}"
+
+# Resolve the generator: prefer a prebuilt binary shipped with the extractor;
+# otherwise build from source with the Go toolchain if it is available.
+GEN_BIN="${GEN_DIR}/bin/lockfile-extension-generator"
+RUN_GENERATOR=""
+if [ -x "${GEN_BIN}" ]; then
+    RUN_GENERATOR="${GEN_BIN}"
+elif command -v go >/dev/null 2>&1; then
+    BUILT_BIN="${CODEQL_EXTRACTOR_ACTIONS_SCRATCH_DIR:-${PACK_DIR}}/lockfile-extension-generator"
+    echo "Building lockfile-extension-generator from source with 'go build'."
+    ( cd "${GEN_DIR}" && go build -o "${BUILT_BIN}" . )
+    RUN_GENERATOR="${BUILT_BIN}"
+else
+    echo "No lockfile-extension-generator binary and no Go toolchain; skipping lockfile-pinned extension." >&2
+    exit 0
+fi
+
+"${RUN_GENERATOR}" "${SRC_ROOT}" "${EXT_DIR}/pinned_by_lockfile.model.yml"
+
+cat > "${PACK_DIR}/qlpack.yml" <<'EOF'
+name: codeql/actions-lockfile-pins
+version: 0.0.1
+library: true
+warnOnImplicitThis: true
+# Generated per-database from the repository's Actions lockfile by the Actions
+# extractor. Apply it at analysis time with `--model-packs
+# codeql/actions-lockfile-pins` (and `--additional-packs <db>/lockfile-extension`).
+extensionTargets:
+  codeql/actions-all: "*"
+dataExtensions:
+  - ext/*.model.yml
+EOF
+
+echo "Wrote lockfile-pinned data extension to '${PACK_DIR}'."

actions/extractor/tools/lockfile-extension-generator/README.md

@@ -23,6 +23,34 @@ rows ship as a data-extension model pack applied at analysis time via
 same parsing core can later feed an extractor-native relation without changing
 the query.
 
+## Extractor integration
+
+The Actions extractor runs this generator automatically during `codeql database
+create` (see `../generate-lockfile-extension.sh`, invoked from
+`../autobuild.sh`). When the repository has a lockfile, the extractor writes a
+self-contained model pack into the database:
+
+```
+<database>/lockfile-extension/
+  qlpack.yml                        # name: codeql/actions-lockfile-pins
+  ext/pinned_by_lockfile.model.yml  # generated pinnedByLockfileDataModel rows
+```
+
+CodeQL does not auto-apply extensions carried inside a database, so analysis
+must add this pack explicitly:
+
+```
+codeql database analyze <db> \
+  codeql/actions-queries:Security/CWE-829/UnpinnedActionsTag.ql \
+  --additional-packs <db>/lockfile-extension \
+  --model-packs codeql/actions-lockfile-pins
+```
+
+Wiring that flag into the analysis harness (e.g. the CodeQL Action) is the
+remaining integration step and lives outside this repository. Generation is a
+clean no-op for repositories without a lockfile, so the extractor step is safe
+to run unconditionally.
+
 ## Ref normalization
 
 A lockfile records the *resolved* ref for each dependency — the CLI prefers a