actions: drop private actions-lockfile dependency from generator

The generator pulled in github.com/github/actions-lockfile/go purely to parse
a small, stable YAML file, which meant it could not build without a local
clone of that (currently private) module -- forcing a gitignored go.work with
a machine-specific replace and breaking any CI/bazel build.

Parse the minimal core of the lockfile format directly instead (new
lockfile.go: YAML unmarshal, pin-key parsing, and the semver major/minor/full
logic), faithfully mirroring the canonical parser's semantics. The golden
fixture (testdata/expected.yml) is unchanged, byte for byte, which proves the
reimplementation matches. Added unit tests for parsePin, parseSemVer/isFull,
and parseLockfile.

The generator now depends only on gopkg.in/yaml.v3 and builds anywhere the Go
toolchain is available, with no replace directive and no go.work. Verified
end-to-end through the real extractor: on-demand 'go build' during database
create succeeds with a stock toolchain, and the lockfile-pinned ref is still
suppressed while an unlocked ref still fires.

Author: nodeselector

actions/extractor/tools/lockfile-extension-generator/.gitignore

@@ -1,5 +1 @@
 /lockfile-extension-generator
-
-# local-only module workspace carrying the actions-lockfile replace
-go.work
-go.work.sum

actions/extractor/tools/lockfile-extension-generator/README.md

@@ -15,13 +15,14 @@ the query otherwise lacks. Feeding the lockfile's bindings into
 `pinnedByLockfileDataModel` lets the query suppress those references while still
 flagging genuinely unpinned ones.
 
-The generator is deliberately **transport-agnostic**. It parses the lockfile
-with the canonical parser at `github.com/github/actions-lockfile/go` and emits
-the `[workflow_path, nwo, ref]` rows the query already matches on. Today those
-rows ship as a data-extension model pack applied at analysis time via
-`--model-packs` (the same mechanism as `codeql/immutable-actions-list`). The
-same parsing core can later feed an extractor-native relation without changing
-the query.
+The generator is deliberately **transport-agnostic**. It parses the minimal,
+stable core of the lockfile format directly (see `lockfile.go`) and emits the
+`[workflow_path, nwo, ref]` rows the query already matches on. It has no
+dependency on the `github.com/github/actions-lockfile` module, so it builds
+anywhere the Go toolchain is available. Today those rows ship as a
+data-extension model pack applied at analysis time via `--model-packs` (the same
+mechanism as `codeql/immutable-actions-list`). The same parsing core can later
+feed an extractor-native relation without changing the query.
 
 ## Extractor integration
 
@@ -77,16 +78,19 @@ writing anything, so it is safe to run unconditionally.
 
 ## Building and testing locally
 
-`github.com/github/actions-lockfile` is not yet public, so the module cannot be
-fetched by the module proxy. Point the `replace` directive in `go.mod` at a
-local clone before building or testing:
+The generator depends only on `gopkg.in/yaml.v3`, so it builds and tests with a
+stock Go toolchain and no special setup:
 
 ```
-go mod edit -replace github.com/github/actions-lockfile/go=/path/to/actions-lockfile/go
+go build ./...
 go test ./...
 ```
 
-Remove the `replace` directive once actions-lockfile is published.
+The golden test (`testdata/expected.yml`) pins the exact generated output for a
+representative lockfile, so any change to parsing or ref normalization must be
+reflected there deliberately. The lockfile parsing in `lockfile.go` mirrors the
+canonical semantics of `github.com/github/actions-lockfile`; if that format
+evolves, update `lockfile.go` and the golden fixture together.
 
 ## End-to-end check
 

actions/extractor/tools/lockfile-extension-generator/generator.go

@@ -3,20 +3,23 @@
 // `pinnedByLockfileDataModel` extensible predicate consumed by the
 // `actions/unpinned-tag` query.
 //
-// The generator is deliberately transport-agnostic: it parses the lockfile with
-// the canonical parser at `github.com/github/actions-lockfile/go` and emits the
-// same `[workflow_path, nwo, ref]` rows the query already matches on. Today those
-// rows are shipped as a data-extension model pack (applied at analysis time via
-// `--model-packs`, exactly like `codeql/immutable-actions-list`). The same parsing
-// core can later feed an extractor-native TRAP relation without changing the query.
+// The generator is deliberately transport-agnostic: it parses the lockfile and
+// emits the same `[workflow_path, nwo, ref]` rows the query already matches on.
+// Today those rows are shipped as a data-extension model pack (applied at
+// analysis time via `--model-packs`, exactly like `codeql/immutable-actions-list`).
+// The same parsing core can later feed an extractor-native TRAP relation without
+// changing the query.
+//
+// The lockfile format is owned by `github.com/github/actions-lockfile`; this
+// generator parses the minimal, stable core it needs directly (see lockfile.go)
+// so it has no dependency on that (currently private) module and builds anywhere
+// the Go toolchain is available.
 package main
 
 import (
 	"fmt"
 	"sort"
 	"strings"
-
-	"github.com/github/actions-lockfile/go/pkg/lockfile"
 )
 
 // row is a single `pinnedByLockfileDataModel` tuple: the reference
@@ -39,26 +42,26 @@ type row struct {
 // `uses: owner/action@v4` be recognised as pinned by a lockfile entry that
 // resolved to `v4.3.1`, which is the common real-world case.
 func rowsFromLockfile(contents []byte) ([]row, error) {
-	f, err := lockfile.Parse(contents)
+	doc, err := parseLockfile(contents)
 	if err != nil {
-		return nil, fmt.Errorf("parsing lockfile: %w", err)
+		return nil, err
 	}
 
 	seen := make(map[row]struct{})
-	for workflowPath, pinKeys := range f.Workflows {
+	for workflowPath, pinKeys := range doc.Workflows {
 		for _, key := range pinKeys {
-			pin, ok := lockfile.ParsePin(key)
+			nwo, keyRef, ok := parsePin(key)
 			if !ok {
 				continue
 			}
 			// Prefer the resolved ref recorded in the dependency metadata; fall
 			// back to the ref embedded in the pin key.
-			ref := pin.Ref
-			if dep, ok := f.Dependencies[key]; ok && dep.Ref != "" {
+			ref := keyRef
+			if dep, ok := doc.Dependencies[key]; ok && dep.Ref != "" {
 				ref = dep.Ref
 			}
 			for _, r := range refVariants(ref) {
-				seen[row{workflowPath: workflowPath, nwo: pin.NWO, ref: r}] = struct{}{}
+				seen[row{workflowPath: workflowPath, nwo: nwo, ref: r}] = struct{}{}
 			}
 		}
 	}
@@ -84,15 +87,15 @@ func rowsFromLockfile(contents []byte) ([]row, error) {
 // this is the tag itself plus its major.minor (`v4.3`) and major-only (`v4`)
 // forms; for anything else (a branch, a partial tag, a SHA) it is just the ref.
 func refVariants(ref string) []string {
-	sv, ok := lockfile.ParseSemVer(ref)
-	if !ok || !sv.IsFull() {
+	sv, ok := parseSemVer(ref)
+	if !ok || !sv.isFull() {
 		return []string{ref}
 	}
 	variants := []string{ref}
-	if minor := sv.MinorTag(); minor != ref {
+	if minor := sv.minorTag(); minor != ref {
 		variants = append(variants, minor)
 	}
-	if major := sv.MajorTag(); major != ref {
+	if major := sv.majorTag(); major != ref {
 		variants = append(variants, major)
 	}
 	return variants

actions/extractor/tools/lockfile-extension-generator/go.mod

@@ -2,14 +2,4 @@ module github.com/github/codeql/actions/extractor/tools/lockfile-extension-gener
 
 go 1.23
 
-require github.com/github/actions-lockfile/go v0.0.0-00010101000000-000000000000
-
-require gopkg.in/yaml.v3 v3.0.1 // indirect
-
-// LOCAL TESTING ONLY: github.com/github/actions-lockfile is not yet public, so it
-// cannot be fetched by the module proxy. Point this at a local clone of the
-// repository to build and test the generator:
-//
-//   go mod edit -replace github.com/github/actions-lockfile/go=/path/to/actions-lockfile/go
-//
-// Remove this replace directive once actions-lockfile is published.
+require gopkg.in/yaml.v3 v3.0.1

actions/extractor/tools/lockfile-extension-generator/go.sum

@@ -1,9 +1,3 @@
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

actions/extractor/tools/lockfile-extension-generator/lockfile.go

@@ -0,0 +1,140 @@
+package main
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+// lockfilePath is the repo-relative location of the GitHub Actions lockfile.
+const lockfilePath = ".github/workflows/actions.lock"
+
+// lockfileDoc is the subset of the Actions lockfile (schema v0.0.2) that the
+// generator needs: the per-workflow flat list of canonical pin keys, and the
+// resolved ref recorded for each dependency.
+//
+// The full format is owned by `github.com/github/actions-lockfile`. We parse it
+// directly here rather than depending on that (currently private) module so the
+// generator builds anywhere the Go toolchain is available, with no module-proxy
+// access to a private repository. The fields we read are a stable, minimal core
+// of the format; see the schema in that repository for the authoritative shape.
+type lockfileDoc struct {
+	Version      string                        `yaml:"version"`
+	Workflows    map[string][]string           `yaml:"workflows"`
+	Dependencies map[string]lockfileDependency `yaml:"dependencies"`
+}
+
+type lockfileDependency struct {
+	Ref    string `yaml:"ref"`
+	Commit string `yaml:"commit"`
+}
+
+func parseLockfile(contents []byte) (*lockfileDoc, error) {
+	var doc lockfileDoc
+	if err := yaml.Unmarshal(contents, &doc); err != nil {
+		return nil, fmt.Errorf("parsing lockfile YAML: %w", err)
+	}
+	return &doc, nil
+}
+
+// parsePin parses a canonical lockfile pin key of the form "OWNER/REPO@REF".
+//
+// It mirrors `lockfile.ParsePin`: the "@" separates repo from ref, the repo
+// portion must contain exactly one "/", owner and repo are lower-cased (git
+// forges treat them case-insensitively) while the ref preserves its casing, and
+// a ref may not be empty or contain a colon. Sub-action paths
+// ("owner/repo/sub@ref") are rejected because the lockfile pins at repo+ref
+// granularity. Returns ok=false for anything that does not match.
+func parsePin(s string) (nwo, ref string, ok bool) {
+	atIdx := strings.IndexByte(s, '@')
+	if atIdx <= 0 || atIdx == len(s)-1 {
+		return "", "", false
+	}
+	repoPath := s[:atIdx]
+	ref = s[atIdx+1:]
+
+	if strings.Count(repoPath, "/") != 1 {
+		return "", "", false
+	}
+	slashIdx := strings.IndexByte(repoPath, '/')
+	owner := repoPath[:slashIdx]
+	repo := repoPath[slashIdx+1:]
+	if owner == "" || repo == "" {
+		return "", "", false
+	}
+	if ref == "" || strings.Contains(ref, ":") {
+		return "", "", false
+	}
+	nwo = strings.ToLower(owner) + "/" + strings.ToLower(repo)
+	return nwo, ref, true
+}
+
+// semVer holds the parsed components of a semver-ish Actions tag. The scheme is
+// deliberately lax (bare "2.0.0", partial "v4"/"v4.2", arbitrary suffixes all
+// appear in the wild), matching `lockfile.SemVer`.
+type semVer struct {
+	prefix string
+	major  int
+	minor  int
+	patch  int
+	rest   string
+	raw    string
+}
+
+var versionRE = regexp.MustCompile(`^(v?)(\d+)(?:\.(\d+))?(?:\.(\d+))?(.*)$`)
+
+func parseSemVer(tag string) (semVer, bool) {
+	if isFullSha(tag) {
+		return semVer{}, false
+	}
+	m := versionRE.FindStringSubmatch(tag)
+	if m == nil {
+		return semVer{}, false
+	}
+	major, err := strconv.Atoi(m[2])
+	if err != nil {
+		return semVer{}, false
+	}
+	minor := 0
+	if m[3] != "" {
+		if minor, err = strconv.Atoi(m[3]); err != nil {
+			return semVer{}, false
+		}
+	}
+	patch := 0
+	if m[4] != "" {
+		if patch, err = strconv.Atoi(m[4]); err != nil {
+			return semVer{}, false
+		}
+	}
+	return semVer{prefix: m[1], major: major, minor: minor, patch: patch, rest: m[5], raw: tag}, true
+}
+
+func (s semVer) majorTag() string { return fmt.Sprintf("%s%d", s.prefix, s.major) }
+
+func (s semVer) minorTag() string { return fmt.Sprintf("%s%d.%d", s.prefix, s.major, s.minor) }
+
+// isFull reports whether the tag has all three components (major.minor.patch)
+// and no pre-release suffix. Tags like "v4" or "v4.2" return false. Only a full
+// version uniquely identifies a release, so only full versions get expanded
+// into their shorter mutable forms.
+func (s semVer) isFull() bool {
+	return s.rest == "" && s.raw != s.majorTag() && s.raw != s.minorTag()
+}
+
+// isFullSha reports whether s looks like a full commit hash (SHA-1 or SHA-256),
+// which must not be treated as a version tag.
+func isFullSha(s string) bool {
+	if len(s) != 40 && len(s) != 64 {
+		return false
+	}
+	for _, c := range s {
+		if !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F')) {
+			return false
+		}
+	}
+	return true
+}

actions/extractor/tools/lockfile-extension-generator/lockfile_test.go

@@ -0,0 +1,92 @@
+package main
+
+import "testing"
+
+func TestParsePin(t *testing.T) {
+	cases := []struct {
+		in      string
+		wantNWO string
+		wantRef string
+		wantOK  bool
+	}{
+		{"actions/checkout@v4.3.1", "actions/checkout", "v4.3.1", true},
+		{"Some-Owner/Pinned-Action@v1.2.0", "some-owner/pinned-action", "v1.2.0", true}, // owner/repo lower-cased, ref preserved
+		{"owner/repo@V1.2.0", "owner/repo", "V1.2.0", true},                             // ref casing preserved
+		{"owner/repo@sha1-deadbeef", "owner/repo", "sha1-deadbeef", true},               // colon-free ref accepted
+		{"owner/repo", "", "", false},                                                   // no @
+		{"owner/repo@", "", "", false},                                                  // empty ref
+		{"@v1", "", "", false},                                                          // no repo path
+		{"owner/repo/sub@v1", "", "", false},                                            // sub-action path rejected
+		{"owneronly@v1", "", "", false},                                                 // no slash
+		{"owner/repo@ref:with:colon", "", "", false},                                    // colon rejected
+	}
+	for _, c := range cases {
+		nwo, ref, ok := parsePin(c.in)
+		if ok != c.wantOK || nwo != c.wantNWO || ref != c.wantRef {
+			t.Errorf("parsePin(%q) = (%q, %q, %v), want (%q, %q, %v)",
+				c.in, nwo, ref, ok, c.wantNWO, c.wantRef, c.wantOK)
+		}
+	}
+}
+
+func TestParseSemVerAndIsFull(t *testing.T) {
+	cases := []struct {
+		tag       string
+		wantOK    bool
+		wantFull  bool
+		wantMajor string
+		wantMinor string
+	}{
+		{"v4.3.1", true, true, "v4", "v4.3"},
+		{"4.3.1", true, true, "4", "4.3"}, // bare, no "v" prefix
+		{"v4", true, false, "v4", "v4.0"},
+		{"v4.3", true, false, "v4", "v4.3"},
+		{"v2.0.0-beta.1", true, false, "v2", "v2.0"}, // pre-release: not full
+		{"main", false, false, "", ""},
+		{"0123456789abcdef0123456789abcdef01234567", false, false, "", ""}, // 40-char SHA
+	}
+	for _, c := range cases {
+		sv, ok := parseSemVer(c.tag)
+		if ok != c.wantOK {
+			t.Errorf("parseSemVer(%q) ok = %v, want %v", c.tag, ok, c.wantOK)
+			continue
+		}
+		if !ok {
+			continue
+		}
+		if got := sv.isFull(); got != c.wantFull {
+			t.Errorf("parseSemVer(%q).isFull() = %v, want %v", c.tag, got, c.wantFull)
+		}
+		if got := sv.majorTag(); got != c.wantMajor {
+			t.Errorf("parseSemVer(%q).majorTag() = %q, want %q", c.tag, got, c.wantMajor)
+		}
+		if got := sv.minorTag(); got != c.wantMinor {
+			t.Errorf("parseSemVer(%q).minorTag() = %q, want %q", c.tag, got, c.wantMinor)
+		}
+	}
+}
+
+func TestParseLockfile(t *testing.T) {
+	doc, err := parseLockfile([]byte(`version: 'v0.0.2'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v4.3.1'
+dependencies:
+    'actions/checkout@v4.3.1':
+        ref: 'v4.3.1'
+        commit: 'sha1-abc'
+`))
+	if err != nil {
+		t.Fatalf("parseLockfile: %v", err)
+	}
+	if doc.Version != "v0.0.2" {
+		t.Errorf("version = %q, want v0.0.2", doc.Version)
+	}
+	keys := doc.Workflows[".github/workflows/ci.yml"]
+	if len(keys) != 1 || keys[0] != "actions/checkout@v4.3.1" {
+		t.Errorf("workflows entry = %v", keys)
+	}
+	if dep := doc.Dependencies["actions/checkout@v4.3.1"]; dep.Ref != "v4.3.1" {
+		t.Errorf("dependency ref = %q, want v4.3.1", dep.Ref)
+	}
+}