actions: use US spelling in lockfile-aware pinning comments

behaviour -> behavior, recognised -> recognized, serialises -> serializes across the lockfile-aware pinning comments and change notes. Comments/docs only; no logic change.

Author: nodeselector

actions/extractor/tools/lockfile-extension-generator/generator.go

@@ -39,7 +39,7 @@ type row struct {
 // shorter, mutable tag such as `v4` or `v4.3` in `uses:`. The query matches on
 // the ref exactly as written, so for every full-semver resolved ref we also
 // emit its major-only (`v4`) and major.minor (`v4.3`) forms. This lets a
-// `uses: owner/action@v4` be recognised as pinned by a lockfile entry that
+// `uses: owner/action@v4` be recognized as pinned by a lockfile entry that
 // resolved to `v4.3.1`, which is the common real-world case.
 func rowsFromLockfile(contents []byte) ([]row, error) {
 	doc, err := parseLockfile(contents)
@@ -101,7 +101,7 @@ func refVariants(ref string) []string {
 	return variants
 }
 
-// renderExtension serialises `rows` as a CodeQL data-extension YAML document that
+// renderExtension serializes `rows` as a CodeQL data-extension YAML document that
 // adds to the `pinnedByLockfileDataModel` extensible predicate in
 // `codeql/actions-all`.
 func renderExtension(rows []row) string {

actions/ql/lib/change-notes/2026-07-09-pinned-by-lockfile.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* Added a new extensible predicate `pinnedByLockfileDataModel(workflow_path, nwo, ref)`, which records `uses:` references that are pinned by a repository's Actions lockfile (`.github/workflows/actions.lock`). The CodeQL Actions extractor generates this data at database-creation time into a database-local model pack (`codeql/actions-lockfile-pins`); it has no effect unless that pack is supplied to analysis (for example via `--model-packs`), so behaviour is unchanged for repositories without a lockfile or analyses that do not opt in.
+* Added a new extensible predicate `pinnedByLockfileDataModel(workflow_path, nwo, ref)`, which records `uses:` references that are pinned by a repository's Actions lockfile (`.github/workflows/actions.lock`). The CodeQL Actions extractor generates this data at database-creation time into a database-local model pack (`codeql/actions-lockfile-pins`); it has no effect unless that pack is supplied to analysis (for example via `--model-packs`), so behavior is unchanged for repositories without a lockfile or analyses that do not opt in.

actions/ql/lib/codeql/actions/config/ConfigExtensions.qll

@@ -78,7 +78,7 @@ extensible predicate trustedActionsOwnerDataModel(string owner);
  * `github.com/github/actions-lockfile/go`. Each lockfile entry binds an `nwo`@`ref` to a
  * verified commit SHA, which is exactly the pinning evidence the `actions/unpinned-tag` query
  * otherwise lacks. Until the extractor populates this predicate it is empty, so any clause that
- * consumes it is a clean no-op and behaviour is unchanged for repositories without a lockfile.
+ * consumes it is a clean no-op and behavior is unchanged for repositories without a lockfile.
  *
  * Fields:
  *  - `workflow_path`: repo-relative path of the file containing the `uses:` reference,

actions/ql/lib/ext/config/pinned_by_lockfile.yml

@@ -15,6 +15,6 @@ extensions:
     #   - [".github/workflows/ci.yml", "actions/checkout", "v4"]
     #
     # Until the extractor populates this predicate it stays empty, so the
-    # `not pinnedByLockfile(...)` clause in `actions/unpinned-tag` is a no-op and behaviour is
+    # `not pinnedByLockfile(...)` clause in `actions/unpinned-tag` is a no-op and behavior is
     # unchanged for repositories without a lockfile.
     data: []

actions/ql/src/change-notes/2026-07-09-unpinned-tag-lockfile-aware.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* The `actions/unpinned-tag` query no longer reports `uses:` references that are recorded as pinned by a repository's Actions lockfile (`.github/workflows/actions.lock`) via the new `pinnedByLockfileDataModel` extensible predicate. The CodeQL Actions extractor generates this data at database-creation time into a database-local model pack (`codeql/actions-lockfile-pins`); references are suppressed only when that pack is supplied to analysis (for example via `--model-packs`), so behaviour is unchanged for repositories without a lockfile or analyses that do not opt in. Because the lockfile keys its pins transitively by workflow path, a stale lockfile could in rare cases suppress a directly-written unpinned tag that shares an action and major version with a transitively-pinned dependency of the same workflow; keeping the lockfile current avoids this.
+* The `actions/unpinned-tag` query no longer reports `uses:` references that are recorded as pinned by a repository's Actions lockfile (`.github/workflows/actions.lock`) via the new `pinnedByLockfileDataModel` extensible predicate. The CodeQL Actions extractor generates this data at database-creation time into a database-local model pack (`codeql/actions-lockfile-pins`); references are suppressed only when that pack is supplied to analysis (for example via `--model-packs`), so behavior is unchanged for repositories without a lockfile or analyses that do not opt in. Because the lockfile keys its pins transitively by workflow path, a stale lockfile could in rare cases suppress a directly-written unpinned tag that shares an action and major version with a transitively-pinned dependency of the same workflow; keeping the lockfile current avoids this.