Repository navigation
[#201] Set up the JDK of the release for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image - #202
Open
vharseko wants to merge 2 commits into
Conversation
…dependencies, as in the other projects The github-actions updates of OpenAM, OpenDJ and OpenIDM are labelled ci and dependencies. The ones of this repository had no labels.
…QL Java analysis, so that its results no longer follow the default JDK of the runner image Fixes OpenIdentityPlatform#201 With build-mode 'none' CodeQL infers no JDK from the project and models the JDK API on the java found on the PATH. When ubuntu-latest moved to ubuntu-26.04 on 2026-10-19 that java became 25 instead of 17, and code scanning opened alerts for APIs deprecated only after Java 11, the version the release is built with. The java-kotlin job now sets up the JDK of the release before Initialize CodeQL, with the setup-java parameters of release.yml: temurin, 8 on sustaining/1.8.x and 11 otherwise. The commented-out JDK step of the manual build is gone, since the step now serves it too.
vharseko
added
bug
maximthomas
approved these changes
Oct 23, 2026
maximthomas
left a comment
maximthomas
left a comment
Contributor
There was a problem hiding this comment.
praise: The JDK pin sits exactly where the alerts come from, and the PR's own run proves it took effect.
- The
Set up JDKstep runs beforeInitialize CodeQLand only formatrix.language == 'java-kotlin'(.github/workflows/codeql.yml:79-84); the PR's java-kotlin job logs[autobuild] Java version: 11.0.32.1, vendor: Eclipse Adoptiumand "using the java on the PATH", where master logged25.0.4.1. - The description states the limit of its own test: a diff-scoped PR analysis cannot show the master alerts closing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #201
Problem
The java-kotlin job of the CodeQL workflow runs with
build-mode: noneand sets up no JDK. CodeQL infers no JDK from the project (No specific JDK inferred from the project being analysed; using the java on the PATH), so it models the JDK API on the defaultjavaof the runner image. On 2026-10-19ubuntu-latestmoved from ubuntu-24.04 to ubuntu-26.04, and thatjavachanged from 17 to 25. Code scanning then opened alerts for APIs deprecated only after Java 11, the version the release is built with. The details are in #201.Fix
.github/dependabot.ymllabels the github-actions pull requestscianddependencies, as in OpenAM, OpenDJ and OpenIDM.Initialize CodeQL, the java-kotlin job sets up the JDK that the release is built with, with theactions/setup-javaparameters ofrelease.yml: temurin, 8 onsustaining/1.8.xand 11 otherwise. The branch is taken fromgithub.base_reffor a pull request and fromgithub.ref_namefor a push.The other languages do not use the step. The same change for OpenDJ is OpenIdentityPlatform/OpenDJ#1232.
Test
The change only takes effect in a CodeQL run, so the CodeQL run of this PR is the test. The java-kotlin job log must show
Java version: 11...fromEclipse Adoptium, where master showsJava version: 25.0.4.1.A pull request analysis only reports results on the changed lines, so it cannot show the alerts going away. They are closed by the first analysis of master after the merge.