Go: Model log/slog as a logging sink

[sauyon]

The standard-library structured logger log/slog (Go 1.21+) was not modeled, so go/log-injection and go/clear-text-logging were blind to any code that logs through it.

Model its logging functions and *slog.Logger methods — Debug, Info, Warn, Error, their Context variants, and Log/LogAttrs — as log-injection sinks (the kind that feeds LoggerCall, powering both queries). Adds log/slog cases to the LoggerCall library test.

[Copilot]

Pull request overview

Adds CodeQL Go sink modeling for the standard-library log/slog (Go 1.21+) so that go/log-injection and go/clear-text-logging can recognize slog logging calls via LoggerCall, and extends the corresponding library test coverage.

Changes:

• Added sinkModel entries for log/slog package-level functions and *slog.Logger methods (including Context variants and Log/LogAttrs).
• Added log/slog call sites to the LoggerCall library test suite.
• Bumped the test module’s Go version to 1.21 to enable log/slog.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
go/ql/test/library-tests/semmle/go/concepts/LoggerCall/slog.go	Adds slog call sites with inline expectations for LoggerCall.
go/ql/test/library-tests/semmle/go/concepts/LoggerCall/main.go	Introduces key constant and invokes slogTest().
go/ql/test/library-tests/semmle/go/concepts/LoggerCall/go.mod	Updates Go version to 1.21 for log/slog availability.
go/ql/lib/ext/log.slog.model.yml	Adds log/slog sink models for log-injection.
go/ql/lib/change-notes/2026-06-17-model-log-slog.md	Documents the new log/slog models in change notes.

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

go

Generated file changes for go

• Changes to framework-coverage-go.rst:

-    `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,612,104
+    `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,612,124
-    Totals,,688,1072,1557
+    Totals,,688,1072,1577

• Changes to framework-coverage-go.csv:

- log,20,,3,,,,20,,,,,,,,,,,,,,,,,,,3,
+ log,40,,3,,,,40,,,,,,,,,,,,,,,,,,,3,