Go: Add database source models for uptrace/bun and gogf/gf/database/gdb

[owen-mc]

This completes the remaining work from #17905.

[Copilot]

Pull Request Overview

This pull request adds local source models for database APIs from the packages github.com/uptrace/bun and github.com/gogf/gf/database/gdb, along with corresponding tests and configuration updates.

• Introduces test files to exercise new database API models for uptrace/bun and gogf/gf/database/gdb.
• Replaces previous placeholder sources (e.g. "github.com/nonexistent/sources") with a generic "test" identifier.
• Updates CodeQL extension models and change notes to support the new source models.

Reviewed Changes

Copilot reviewed 12 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test_uptrace_bun.go	Adds tests demonstrating usage of the uptrace/bun API source methods.
go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test_gogf_gf_database_gdb.go	Adds tests demonstrating usage of the gogf/gf/database/gdb API source methods.
go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test_Masterminds_squirrel.go	Replaces usage of the deprecated src.Source with a generic Source function for Masterminds/squirrel.
go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test.ext.yml	Updates test configuration to reference the new source identifier "test".
go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/source.ext.yml	Updates source configuration to reference the new source identifier "test".
go/ql/lib/ext/github.com.uptrace.bun.model.yml	Adds new data models for source methods from uptrace/bun.
go/ql/lib/ext/github.com.gogf.gf.database.gdb.model.yml	Adds new data models for source methods from gogf/gf/database/gdb and summary models.
go/ql/lib/change-notes/2025-03-27-database-local-source-models.md	Adds release notes for the database local source models update.

Files not reviewed (3)

• go/ql/lib/go.qll: Language not supported
• go/ql/lib/semmle/go/frameworks/Bun.qll: Language not supported
• go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/go.mod: Language not supported

Comments suppressed due to low confidence (1)

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test_Masterminds_squirrel.go:11

• The generic Source function returns *new(T), which may yield a nil value when T is instantiated as a pointer type. Consider adding constraints or handling such cases explicitly to ensure that the function returns a valid, non-nil instance in all scenarios.

func Source[T any]() T {

Tip: Copilot code review supports C#, Go, Java, JavaScript, Markdown, Python, Ruby and TypeScript, with more languages coming soon. Learn more

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

go

Generated file changes for go

• Changes to framework-coverage-go.rst:

-    `Bun <https://bun.uptrace.dev/>`_,``github.com/uptrace/bun*``,,,63
+    `Bun <https://bun.uptrace.dev/>`_,``github.com/uptrace/bun*``,8,,63
-    `GoFrame <https://goframe.org/en/>`_,``github.com/gogf/gf*``,,,51
+    `GoFrame <https://goframe.org/en/>`_,``github.com/gogf/gf*``,39,21,51
-    Totals,,641,1048,1556
+    Totals,,688,1069,1556

• Changes to framework-coverage-go.csv:

- github.com/gogf/gf/database/gdb,51,,,,,,,,,,,,,,51,,,,,,,,,,,,
+ github.com/gogf/gf/database/gdb,51,39,21,,,,,,,,,,,,51,,,,,,39,,,,,21,
- github.com/uptrace/bun,63,,,,,,,,,,,,,,63,,,,,,,,,,,,
+ github.com/uptrace/bun,63,8,,,,,,,,,,,,,63,,,,,,8,,,,,,

[smowton]

Haven't reviewed the libs in detail, but looks plausible