Docs: update Actions customization doc to cover JSON extensions

Author: nickrolfe

docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst

@@ -7,7 +7,29 @@ Customizing library models for GitHub Actions
 
 GitHub Actions analysis can be customized by adding library models in data extension files.
 
-A data extension for GitHub Actions is a YAML file of the form:
+A data extension for GitHub Actions can be written using either JSON or YAML. The JSON format takes the following form:
+
+.. code-block:: json
+
+   {
+     "extensions": [
+       {
+         "addsTo": {
+           "pack": "codeql/actions-all",
+           "extensible": "<name of extensible predicate>"
+         },
+         "data": [
+           ["tuple", 1],
+           ["tuple", 2]
+           // ...
+         ]
+       }
+     ]
+   }
+
+Files in the JSON format must use the ``.json`` file extension. Single-line (``//``) and multi-line (``/* ... */``) comments are supported as a non-standard JSON extension.
+
+A YAML file has the following form:
 
 .. code-block:: yaml
 
@@ -16,8 +38,8 @@ A data extension for GitHub Actions is a YAML file of the form:
         pack: codeql/actions-all
         extensible: <name of extensible predicate>
       data:
-        - <tuple1>
-        - <tuple2>
+        - ["tuple", 1]
+        - ["tuple", 2]
         - ...
 
 The CodeQL library for GitHub Actions exposes the following extensible predicates:
@@ -57,16 +79,23 @@ If there is an Action publisher that you trust, you can include the owner name/o
 
 To allow any Action from the publisher ``octodemo``, such as ``octodemo/3rd-party-action``, follow these steps:
 
-1. Create a data extension file ``/models/trusted-owner.model.yml`` with the following content:
+1. Create a data extension file ``/models/trusted-owner.model.json`` with the following content:
 
-   .. code-block:: yaml
+   .. code-block:: json
 
-      extensions:
-        - addsTo:
-            pack: codeql/actions-all
-            extensible: trustedActionsOwnerDataModel
-          data:
-            - ["octodemo"]
+      {
+        "extensions": [
+          {
+            "addsTo": {
+              "pack": "codeql/actions-all",
+              "extensible": "trustedActionsOwnerDataModel"
+            },
+            "data": [
+              ["octodemo"]
+            ]
+          }
+        ]
+      }
 
 2. Create a model pack file ``/codeql-pack.yml`` with the following content:
 
@@ -78,7 +107,7 @@ To allow any Action from the publisher ``octodemo``, such as ``octodemo/3rd-part
       extensionTargets:
         codeql/actions-all: '*'
       dataExtensions:
-        - models/**/*.yml
+        - models/**/*.json
 
 3. Ensure that the model pack is included in your CodeQL analysis.
 
@@ -91,14 +120,21 @@ GitHub's own organizations (``actions``, ``github`` and ``advanced-security``) a
 
 To distrust the first-party ``github`` owner, add a data extension file with the following content:
 
-.. code-block:: yaml
-
-   extensions:
-     - addsTo:
-         pack: codeql/actions-all
-         extensible: trustedActionsOwnerDataModel
-       data:
-         - ["!github"]
+.. code-block:: json
+
+   {
+     "extensions": [
+       {
+         "addsTo": {
+           "pack": "codeql/actions-all",
+           "extensible": "trustedActionsOwnerDataModel"
+         },
+         "data": [
+           ["!github"]
+         ]
+       }
+     ]
+   }
 
 With this in place, the query will once again report unpinned tags for Actions published by ``github``.