fix: normalize CDS $location.file paths for Windows

The SAP CDS compiler on Windows produces $location.file values with
backslashes (e.g. "srv\service1.cds"), causing CodeQL CAP library
path matching to fail. Normalize these to OS-appropriate slashes at
generation time in the CDS extractor, workflow scripts, and a new
standalone normalizer script.

- Add normalizeCdsJsonLocations/normalizeLocationPathsInFile to
  filesystem.ts with 12 unit tests
- Call normalizeLocationPathsInFile after compilation in compile.ts
- Add normalize-cds-json-paths.mjs standalone CLI for workflow use
- Update cds-compilation-for-actions.cmd/.sh to call normalizer
- Fix broken for /r loop in .cmd that skipped subdirectory CDS files
- Update CDL.qll comments to document the normalization contract

Author: data-douser

extractors/cds/tools/dist/cds-extractor.bundle.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+
+/**
+ * Normalize `$location.file` paths in CDS JSON files to use POSIX forward slashes.
+ *
+ * The SAP CDS compiler on Windows produces `$location.file` values with backslashes
+ * (e.g. "srv\\service1.cds"), but the CodeQL CAP libraries expect forward slashes
+ * (e.g. "srv/service1.cds"). This script normalizes all such paths in-place.
+ *
+ * This uses the same algorithm as `normalizeCdsJsonLocations` in
+ * `extractors/cds/tools/src/filesystem.ts`, which has comprehensive unit tests.
+ *
+ * Usage:
+ *   node normalize-cds-json-paths.mjs <file1.cds.json> [file2.cds.json ...]
+ */
+
+import { readFileSync, writeFileSync, existsSync, statSync } from 'fs';
+
+/**
+ * Recursively normalize $location.file values to forward slashes.
+ */
+function normalizeLocations(obj) {
+  if (typeof obj !== 'object' || obj === null) return;
+
+  if (obj['$location']?.file && typeof obj['$location'].file === 'string') {
+    obj['$location'].file = obj['$location'].file.split('\\').join('/');
+  }
+
+  for (const key of ['definitions', 'elements', 'params', 'actions', 'functions', 'items', 'returns']) {
+    const nested = obj[key];
+    if (typeof nested === 'object' && nested !== null && !Array.isArray(nested)) {
+      for (const child of Object.values(nested)) {
+        normalizeLocations(child);
+      }
+    }
+  }
+}
+
+const args = process.argv.slice(2);
+if (args.length === 0) {
+  console.log('Usage: node normalize-cds-json-paths.mjs <file.cds.json> [...]');
+  process.exit(0);
+}
+
+let changed = 0;
+for (const filePath of args) {
+  if (!existsSync(filePath) || !statSync(filePath).isFile()) {
+    console.error(`Skipping (not a file): ${filePath}`);
+    continue;
+  }
+
+  const raw = readFileSync(filePath, 'utf8');
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    console.error(`Skipping (invalid JSON): ${filePath}`);
+    continue;
+  }
+
+  normalizeLocations(data);
+  const normalized = JSON.stringify(data, null, 2) + '\n';
+
+  if (normalized !== raw) {
+    writeFileSync(filePath, normalized, 'utf8');
+    console.log(`Normalized: ${filePath}`);
+    changed++;
+  }
+}
+
+console.log(`Done. ${changed} file(s) normalized out of ${args.length} processed.`);

extractors/cds/tools/dist/cds-extractor.bundle.js.map

@@ -4,7 +4,12 @@ import { basename, delimiter, dirname, join, relative, resolve, sep } from 'path
 import { CdsCompilationResult } from './types';
 import { getCdsVersion } from './version';
 import { modelCdsJsonFile } from '../../constants';
-import { fileExists, dirExists, recursivelyRenameJsonFiles } from '../../filesystem';
+import {
+  fileExists,
+  dirExists,
+  recursivelyRenameJsonFiles,
+  normalizeLocationPathsInFile,
+} from '../../filesystem';
 import { cdsExtractorLog } from '../../logging';
 import { BasicCdsProject } from '../parser/types';
 
@@ -216,6 +221,11 @@ function compileProject(
     cdsExtractorLog('info', `CDS compiler generated JSON to file: ${projectJsonOutPath}`);
   }
 
+  // Normalize $location.file paths to POSIX forward slashes.
+  // The CDS compiler on Windows produces backslash paths (e.g. "srv\\service1.cds")
+  // but CodeQL libraries expect forward slashes (e.g. "srv/service1.cds").
+  normalizeLocationPathsInFile(projectJsonOutPath);
+
   return {
     success: true,
     outputPath: projectJsonOutPath,