Actions lockfiles: ignore schema version value

Author: nodeselector

actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md

@@ -2,4 +2,4 @@
 category: feature
 ---
 * GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
-  provides access to their YAML abstract syntax trees and valid v0.0.2 workflow pins.
+  provides access to their YAML abstract syntax trees and structurally valid workflow pins.

actions/ql/lib/codeql/actions/Lock.qll

@@ -9,8 +9,8 @@ class ActionsLock extends YamlDocument {
   ActionsLock() { this.getFile().getBaseName() = "actions.lock" }
 
   /**
-   * Holds if the v0.0.2 lockfile records `nwo` at `ref` for `workflowPath` with a full commit
-   * digest. Repository pins also cover sub-actions such as `actions/cache/save`.
+   * Holds if the lockfile records `nwo` at `ref` for `workflowPath` with a full commit digest.
+   * Repository pins also cover sub-actions such as `actions/cache/save`.
    */
   bindingset[nwo]
   predicate pins(string workflowPath, string nwo, string ref) {
@@ -20,7 +20,6 @@ class ActionsLock extends YamlDocument {
       string pin, string pinnedNwo
     |
       root = this and
-      root.lookup("version").(YamlScalar).getValue() = "v0.0.2" and
       root.lookup("workflows").(YamlMapping).lookup(workflowPath) = workflowPins and
       workflowPins.getElement(_) = pinNode and
       pin = pinNode.getValue() and

actions/ql/src/change-notes/2026-07-09-unpinned-tag-lockfile-aware.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* The `actions/unpinned-tag` query no longer reports action references pinned by a valid v0.0.2 `.github/workflows/actions.lock` entry for the enclosing workflow.
+* The `actions/unpinned-tag` query no longer reports action references pinned by a structurally valid `.github/workflows/actions.lock` entry for the enclosing workflow.

actions/ql/test/query-tests/Security/CWE-829-Lockfile/.github/workflows/actions.lock

@@ -1,4 +1,4 @@
-version: v0.0.2
+version: future-version
 workflows:
   .github/workflows/rust-ci.yml:
     - dtolnay/rust-toolchain@v1