Can I register complex sources/sinks/sanitizers entirely inside a custom CodeQL pack?

Short background: I want to put all my custom taint modeling (complex QL predicates, annotation equivalence, sanitizers, and normal model files) into a single custom pack so teams can depend on it — without modifying standard / *-all libs.

Concrete example: in Java I have @CustomAnno and I want it treated exactly like Spring’s @RequestMapping (i.e. methods/classes with @CustomAnno are sources). I can do this in Customizations.qll inside java-all/lib, but I don’t want to change the standard lib.

Two short questions:

1. Is it supported to expose complex QL-based sources/sinks/sanitizers from an external pack so the standard taint queries pick them up? If yes — what minimal files/config (qlpack.yml / module layout / naming) are required?

2. If not supported, what is the recommended minimal workaround that keeps good maintainability?

Environment: Java target. I can attach a minimal repro pack if useful.

Thanks!

Review the Java target's Customizations.qll usage under java-all/lib, then inspect the referenced qlpack.yml, module layout, and naming conventions for external packs. Determine whether standard taint queries consume models from an external pack and document the minimal supported configuration or maintainable workaround.

由索引模型根据 Issue 内容生成。