Fix Go extractor incorrectly excluding packages with .. in relative paths

go/extractor/extractor.go

@@ -224,6 +224,12 @@ func ExtractWithFlags(buildFlags []string, patterns []string, extractTests bool)
 		}
 
 		log.Printf("Done extracting types for package %s.", pkg.PkgPath)
+
+		// Add ModDir to wantedRoots for all packages (including cross-module dependencies)
+		// This ensures dependencies from other modules can be extracted
+		if pkgInfo, ok := pkgInfos[pkg.PkgPath]; ok && pkgInfo.ModDir != "" {
+			wantedRoots[pkgInfo.ModDir] = true
+		}
 	})
 
 	if len(pkgsNotFound) > 0 {

go/ql/integration-tests/package-exclusion-fix/build_environment.expected

@@ -0,0 +1,5 @@
+{
+  "configuration" : {
+    "go" : { }
+  }
+}

go/ql/integration-tests/package-exclusion-fix/diagnostics.expected

@@ -0,0 +1,14 @@
+{
+  "markdownMessage": "2 `go.mod` files were found:\n\n`configmodule/go.mod`, `mainmodule/go.mod`",
+  "severity": "note",
+  "source": {
+    "extractorName": "go",
+    "id": "go/autobuilder/multiple-go-mod-found-not-nested",
+    "name": "Multiple `go.mod` files found, not all nested under one root `go.mod` file"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}

go/ql/integration-tests/package-exclusion-fix/src/configmodule/config/config.go

@@ -0,0 +1,9 @@
+package config
+
+type Settings struct {
+    Value string
+}
+
+func Value() string {
+    return Settings{Value: "ok"}.Value
+}

go/ql/integration-tests/package-exclusion-fix/src/configmodule/go.mod

@@ -0,0 +1,3 @@
+module example.com/configmodule
+
+go 1.20

go/ql/integration-tests/package-exclusion-fix/src/go.work

@@ -0,0 +1,4 @@
+go 1.20
+
+use ./mainmodule
+use ./configmodule

go/ql/integration-tests/package-exclusion-fix/src/mainmodule/app/jobs/worker/worker.go

@@ -0,0 +1,7 @@
+package worker
+
+import "example.com/configmodule/config"
+
+func Use() string {
+    return config.Value()
+}

go/ql/integration-tests/package-exclusion-fix/src/mainmodule/go.mod

@@ -0,0 +1,7 @@
+module example.com/mainmodule
+
+go 1.20
+
+require example.com/configmodule v0.0.0
+
+replace example.com/configmodule => ../configmodule

go/ql/integration-tests/package-exclusion-fix/test.expected

@@ -0,0 +1,6 @@
+extractedFiles
+| src/configmodule/config/config.go:0:0:0:0 | src/configmodule/config/config.go |
+| src/configmodule/go.mod:0:0:0:0 | src/configmodule/go.mod |
+| src/mainmodule/app/jobs/worker/worker.go:0:0:0:0 | src/mainmodule/app/jobs/worker/worker.go |
+| src/mainmodule/go.mod:0:0:0:0 | src/mainmodule/go.mod |
+#select

go/ql/integration-tests/package-exclusion-fix/test.py

@@ -0,0 +1,18 @@
+# Test for the package exclusion bug fix.
+#
+# This test reproduces the scenario where a dependency package in a separate module
+# was incorrectly excluded due to relative paths containing ".." when checked against
+# wantedRoots from the main module.
+#
+# Structure:
+# - configmodule/config/ (separate module with config package)
+# - mainmodule/app/jobs/worker/ (main package that depends on config)
+#
+# Bug scenario (old code):
+# When building just mainmodule packages, wantedRoots contains mainmodule directories
+# but NOT configmodule's ModDir. Checking config against mainmodule/app/jobs/worker
+# produces ../../configmodule/config (contains ".."), causing incorrect exclusion.
+#
+# Fix: Adds all dependency ModDirs to wantedRoots and prioritizes checking them first.
+def test(codeql, go):
+    codeql.database.create(source_root="src")

go/ql/integration-tests/package-exclusion-fix/test.ql

@@ -0,0 +1,8 @@
+import go
+import semmle.go.DiagnosticsReporting
+
+query predicate extractedFiles(File f) { any() }
+
+from string msg, int sev
+where reportableDiagnostics(_, msg, sev)
+select msg, sev