Repository navigation
[#1193] Set up the JDK of the release for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image - #1194
Merged
vharseko merged 2 commits intoOct 22, 2026
Conversation
…ther projects do deploy.yml and release.yml set up zulu. The deploy and release workflows of commons, OpenDJ, OpenICF, OpenIDM and OpenIG set up temurin, and the Build workflows of all of them, this one included, set up zulu. Deploy and release now set up temurin here too; build.yml is not changed. The two workflow files get the CDDL header that the workflows of OpenDJ carry.
…eQL Java analysis, so that its results no longer follow the default JDK of the runner image Fixes OpenIdentityPlatform#1193 With build-mode 'none' CodeQL infers no JDK from the project and models the JDK API on the java found on the PATH. When ubuntu-latest moved to ubuntu-26.04 on 2026-10-19 that java became 25 instead of 17, and code scanning opened alerts for APIs deprecated only after Java 11, the version the release is built with. The java-kotlin job now sets up the JDK of the release before Initialize CodeQL, with the setup-java parameters of release.yml: temurin, 8 on sustaining/15.2.x and 11 otherwise. The commented-out JDK step of the manual build is gone, since the step now serves it too.
vharseko
added
bug
security
maximthomas
approved these changes
Oct 22, 2026
maximthomas
left a comment
maximthomas
left a comment
Contributor
There was a problem hiding this comment.
praise: The analysis JDK now comes from the workflow instead of the runner image, and the job log shows it.
Set up JDK(.github/workflows/codeql.yml:84-89) runs beforeInitialize CodeQL, only forjava-kotlin.- This PR's java-kotlin job logs
Java version: 11.0.32.1, vendor: Eclipse Adoptium, while master's push run 39647411727 logs25.0.4.1. Both logNo specific JDK inferred from the project being analysed, which is the mechanism the description states.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1193
Problem
The java-kotlin job of the CodeQL workflow runs with
build-mode: noneand sets up no JDK. CodeQL infers no JDK from the project (No specific JDK inferred from the project being analysed; using the java on the PATH), so it models the JDK API on the defaultjavaof the runner image. On 2026-10-19ubuntu-latestmoved from ubuntu-24.04 to ubuntu-26.04, and thatjavachanged from 17 to 25. Code scanning then opened alerts for APIs deprecated only after Java 11, the version the release is built with. The details are in #1193.Fix
deploy.ymlandrelease.ymlset up temurin instead of zulu, as the deploy and release workflows of commons, OpenDJ, OpenICF, OpenIDM and OpenIG do.build.ymlstays on zulu, like the Build workflows of all of them.Initialize CodeQL, the java-kotlin job sets up the JDK that the release is built with, with theactions/setup-javaparameters ofrelease.yml: temurin, 8 onsustaining/15.2.xand 11 otherwise. The branch is taken fromgithub.base_reffor a pull request and fromgithub.ref_namefor a push.The other languages do not use the step. The same change for OpenDJ is OpenIdentityPlatform/OpenDJ#1232.
Test
The change only takes effect in a CodeQL run, so the CodeQL run of this PR is the test. The java-kotlin job log must show
Java version: 11...fromEclipse Adoptium, where master showsJava version: 25.0.4.1.A pull request analysis only reports results on the changed lines, so it cannot show the alerts going away. They are closed by the first analysis of master after the merge.