Add CommentBase to YAML.qll for compatibility with codeql/yaml@1.0.52 (CodeQL 2.26.0)

[chanel-y]

Summary

CodeQL 2.26.0 bumped codeql/yaml to 1.0.52, which added CommentBase as a required member of the InputSig signature module (github/codeql@e87f7fb — "Shared: Support YAML comments").

This means iac/ql/lib/codeql/iac/YAML.qll will fail to compile against codeql/yaml >= 1.0.52 because YamlSig does not implement CommentBase.

Proposed Fix

Add the following to the YamlSig module in ql/lib/codeql/iac/YAML.qll:

class CommentBase extends LocatableBase, @yaml_comment {
  string getText() { yaml_comments(this, result) }

  override string toString() { result = getText() }
}

This also requires adding @yaml_comment and yaml_comments to the dbscheme (ql/lib/iac.dbscheme), similar to how other languages define them:

@yaml_comment = @yaml_comment_node

yaml_comments(
  unique int id: @yaml_comment ref,
  string text: string ref
);

yaml_locations(@yaml_comment, @location_default);

The extractor itself would also need to be updated to extract YAML comments into the yaml_comments table. Until then, the dbscheme tables will simply be empty, but the library will compile.

Context

• CodeQL 2.26.0 release: bumps codeql/yaml to 1.0.52
• Upstream commit: github/codeql@e87f7fb3f75
• InputSig now requires CommentBase: https://github.com/github/codeql/blob/main/shared/yaml/codeql/yaml/Yaml.qll#L143
• Other languages (JS, Python, Ruby) already implement this

Impact

Without this fix, advanced-security/iac-queries cannot depend on codeql/yaml >= 1.0.52 and is incompatible with CodeQL 2.26.0.