Fix Go extractor incorrectly excluding packages with .. in relative paths

[allsmog]

Summary

Fixes a bug where cross-module workspace dependencies were incorrectly excluded from extraction.

Problem

When using go.work workspaces with multiple modules:

1. Only input packages ModDirs were added to wantedRoots
2. Cross-module dependencies had their ModDir excluded
3. Checking dependencies against sibling packages produced .. paths → excluded

Example

/project/
  go.work
  configmodule/config/config.go  <-- Excluded
  mainmodule/app/jobs/worker/worker.go

Solution

Add ModDir to wantedRoots for all packages (6-line change in type extraction loop).

Testing

Integration test at go/ql/integration-tests/package-exclusion-fix/:

• Without fix: 2 files (config.go missing)
• With fix: 4 files (config.go present)

Run: pytest go/ql/integration-tests/package-exclusion-fix/

Impact

Low risk, high value for multi-module workspaces, backward compatible.

[owen-mc]

Thank you for this contribution to CodeQL. Would it be possible to turn your example into a test, to make it easier to confirm that this was failing without your change and passing with it, and to make sure it doesn't regress in future? You could start with a copy of go/ql/integration-tests/two-go-mods-not-nested/ (or one of its siblings) to get the basic structure. To run this test, the command pytest go/ql/integration-tests/two-go-mods-not-nested/ from the repository root should work.

[owen-mc]

Your test doesn't include an import with ".." in a relative path. I see it includes a relative path with ".." in it in a replace directive, but it isn't clear if that will have the same effect. But the result of the test is fine without any code changes. To move forward we first need to get a test which fails without any code changes, to demonstrate the problem.