actions: emit empty data list for zero-row lockfile extension

A lockfile that pins no repo-level actions (e.g. only sub-path actions like github/codeql-action/init@v3, which parsePin skips) produced a bare `data:` (YAML null) extension, which CodeQL's `resolve extensions-by-pack` rejects and aborts the analysis. Emit `data: []` for the zero-row case, matching the repo convention, and note the narrow transitive-per-path over-suppression edge in the change note.

Author: nodeselector

actions/extractor/tools/lockfile-extension-generator/generator.go

@@ -112,6 +112,16 @@ func renderExtension(rows []row) string {
 	b.WriteString("  - addsTo:\n")
 	b.WriteString("      pack: codeql/actions-all\n")
 	b.WriteString("      extensible: pinnedByLockfileDataModel\n")
+	// `data` must be a YAML sequence. When there are no rows we must emit an
+	// explicit empty list (`data: []`); a bare `data:` parses as null, which
+	// CodeQL's extension loader rejects (`resolve extensions-by-pack` fails and
+	// aborts the whole analysis). Zero rows is reachable whenever a lockfile is
+	// present but pins no repo-level actions (e.g. only sub-path actions such as
+	// `github/codeql-action/init@v3`, which `parsePin` intentionally skips).
+	if len(rows) == 0 {
+		b.WriteString("    data: []\n")
+		return b.String()
+	}
 	b.WriteString("    data:\n")
 	for _, r := range rows {
 		fmt.Fprintf(&b, "      - [%q, %q, %q]\n", r.workflowPath, r.nwo, r.ref)

actions/extractor/tools/lockfile-extension-generator/generator_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"os"
+	"strings"
 	"testing"
 )
 
@@ -89,3 +90,24 @@ func TestRenderExtensionMatchesGolden(t *testing.T) {
 		t.Errorf("rendered extension does not match testdata/expected.yml:\n--- got ---\n%s", got)
 	}
 }
+
+func TestRenderExtensionZeroRowsEmitsEmptyList(t *testing.T) {
+	// A lockfile that pins only sub-path actions (skipped by parsePin) or an
+	// empty `workflows` map yields zero rows while a lockfile is present. The
+	// rendered extension must use `data: []`, not a bare `data:` (YAML null),
+	// which CodeQL's extension loader rejects and which aborts the analysis.
+	rows, err := rowsFromLockfile([]byte("version: \"v0.0.2\"\nworkflows:\n  \".github/workflows/ci.yml\":\n    - \"github/codeql-action/init@v3\"\ndependencies: {}\n"))
+	if err != nil {
+		t.Fatalf("rowsFromLockfile: %v", err)
+	}
+	if len(rows) != 0 {
+		t.Fatalf("expected zero rows for a sub-path-only lockfile, got %d: %v", len(rows), rows)
+	}
+	got := renderExtension(rows)
+	if !strings.Contains(got, "data: []") {
+		t.Errorf("zero-row extension must emit `data: []`, got:\n%s", got)
+	}
+	if strings.Contains(got, "data:\n") {
+		t.Errorf("zero-row extension must not emit a null `data:` line, got:\n%s", got)
+	}
+}

actions/ql/src/change-notes/2026-07-09-unpinned-tag-lockfile-aware.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* The `actions/unpinned-tag` query no longer reports `uses:` references that are recorded as pinned by a repository's Actions lockfile (`.github/workflows/actions.lock`) via the new `pinnedByLockfileDataModel` extensible predicate. The CodeQL Actions extractor generates this data at database-creation time into a database-local model pack (`codeql/actions-lockfile-pins`); references are suppressed only when that pack is supplied to analysis (for example via `--model-packs`), so behaviour is unchanged for repositories without a lockfile or analyses that do not opt in.
+* The `actions/unpinned-tag` query no longer reports `uses:` references that are recorded as pinned by a repository's Actions lockfile (`.github/workflows/actions.lock`) via the new `pinnedByLockfileDataModel` extensible predicate. The CodeQL Actions extractor generates this data at database-creation time into a database-local model pack (`codeql/actions-lockfile-pins`); references are suppressed only when that pack is supplied to analysis (for example via `--model-packs`), so behaviour is unchanged for repositories without a lockfile or analyses that do not opt in. Because the lockfile keys its pins transitively by workflow path, a stale lockfile could in rare cases suppress a directly-written unpinned tag that shares an action and major version with a transitively-pinned dependency of the same workflow; keeping the lockfile current avoids this.