Fix is not an extension target of warning for extension packs

[Copilot]

codeql pack create/publish on every <language>/ext and <language>/ext-library-sources pack emitted a warning per data extension:

WARNING: In extension for codeql/csharp-all:sinkModel, addsTo.pack 'codeql/csharp-all' is not an
extension target of 'githubsecuritylab/codeql-csharp-extensions'. This warning will become an error
in future versions of CodeQL.

Root cause

These are CodeQL model/extension packs (extensionTargets, deliberately no dependencies). Running codeql pack install/upgrade against them still (re)writes their codeql-pack.lock.yml with an empty dependencies: {} map. A checked-in lock file in that state trips a known CodeQL CLI bug (github/codeql#20211): a later pack create/publish then can't resolve the addsTo.pack target and falsely warns, for every data extension file, even though extensionTargets correctly declares it.

Confirmed locally: with the checked-in lock file present, codeql pack create produced 8–2276 warnings per affected directory; deleting it drops that to 0.

Changes

• Removed stale lock files — deleted the 6 checked-in codeql-pack.lock.yml files under csharp/ext, csharp/ext-library-sources, java/ext, java/ext-library-sources, python/ext, go/ext.
• Stopped regenerating them — dropped the codeql pack install step before create/publish for ext/ext-library-sources in ci.yml, publish.yml, and pr-suites-packs.sh (these packs have nothing to install anyway).
• Excluded from the upgrade loop — update-codeql-version.yml's codeql pack upgrade sweep now skips */ext and */ext-library-sources directories, so the lock file can't reappear on the next CLI bump.
• Documented the quirk — added a note in CONTRIBUTING.md explaining why these two pack types are never installed/upgraded, alongside the existing ql/hotspots exclusion note.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Review details

• Files reviewed: 11/11 changed files
• Comments generated: 0 new
• Review effort level: Low

[felickz]

@copilot why is this causing python extension pack to fail ?

https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/actions/runs/30306426958/job/90112220840?pr=191

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

@copilot why is this causing python extension pack to fail ?

https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/actions/runs/30306426958/job/90112220840?pr=191

This PR removes the empty lock file that was masking a separate Python compatibility issue. In that job, gh codeql pack create python/ext now resolves codeql/python-all@7.2.1 from extensionTargets and validates the models against the real schema. That exposes pre-existing invalid rows in python/ext, for example python/ext/generated/flask.model.yml still uses the old source and sink layout with a separate Argument[...] or ReturnValue column, but codeql/python-all 7.2.1 now expects that accessor to be folded into the path column. There is also at least one malformed summary row in python/ext/generated/openai.model.yml:30. So this change did not introduce the Python model breakage. It unmasked an existing schema mismatch that the bogus lockfile path had been hiding.

[felickz]

@copilot python pack create still failing.. is this cmd running fine local vs ci?

https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/actions/runs/30308523274/job/90158850898?pr=191

[Copilot]

Review details

• Files reviewed: 11/11 changed files
• Comments generated: 1
• Review effort level: Low

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

@copilot python pack create still failing.. is this cmd running fine local vs ci?

https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/actions/runs/30308523274/job/90158850898?pr=191

The failure was schema validation errors (not the is not an extension target warning). With codeql/python-all@7.2.1, sourceModel and sinkModel changed from a 4-column format [type, path, accessPath, kind] to a 3-column format [type, path, kind] where path now includes the full access path. The generated model files (flask.model.yml, ghastoolkit.model.yml, openai.model.yml, pymysql.model.yml, urllib3.model.yml, werkzeug.model.yml) still used the old 4-column layout, producing ERROR: row N is invalid entries that caused codeql resolve extensions-by-pack to exit with code 2. There was also one malformed 4-column summaryModel row in openai.model.yml that was dropped.

Fixed in the latest commit by merging path and accessPath with a . separator throughout all affected files. Validated locally: codeql pack create python/ext/ now exits 0 with no schema errors.

[felickz]

@copilot what happened to the lock file deletion? All the changes brought them back - intentional or unintentional? Are they needed? Should they be removed again?

Removed stale lock files — deleted the 6 checked-in codeql-pack.lock.yml files under csharp/ext, csharp/ext-library-sources, java/ext, java/ext-library-sources, python/ext, go/ext.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

@copilot what happened to the lock file deletion? All the changes brought them back - intentional or unintentional? Are they needed? Should they be removed again?

Removed stale lock files — del...

Unintentional. The "placeholder" commit I pushed while starting the schema migration accidentally re-staged all 6 lock files that the earlier 8acab3d commit had deleted. They should not be there. Removed them again in the latest commit.