Repository navigation
[#263] Set up the JDK of the release for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image - #264
Open
vharseko wants to merge 1 commit into
Conversation
…QL Java analysis, so that its results no longer follow the default JDK of the runner image Fixes OpenIdentityPlatform#263 With build-mode 'none' CodeQL infers no JDK from the project and models the JDK API on the java found on the PATH. When ubuntu-latest moved to ubuntu-26.04 on 2026-10-19 that java became 25 instead of 17, and code scanning opened alerts for APIs deprecated only after Java 17, the version the release is built with. The java-kotlin job now sets up the JDK of the release before Initialize CodeQL, with the setup-java parameters of release.yml: temurin, 8 on sustaining/6.3.x and 17 otherwise.
vharseko
added
bug
maximthomas
approved these changes
Oct 23, 2026
maximthomas
left a comment
maximthomas
left a comment
Contributor
There was a problem hiding this comment.
praise: The analysis JDK now comes from the workflow instead of the runner image, and the job log shows it.
Set up JDK(.github/workflows/codeql.yml:63-68) runs beforeInitialize CodeQL, only forjava-kotlin, with theactions/setup-java@v6tag andtemurindistribution ofrelease.yml:47-50.- Run 39763486253's java-kotlin job logs
Setting Java 17.0.20+1 as the defaultand the extractor'sNo specific JDK inferred from the project being analysed; using the java on the PATH, the mechanism the description states. - JDK 17 carries no
@DeprecatedonURL(String)orMemoryMXBean.getObjectPendingFinalizationCount()(checked on 17.0.11; 25.0.2 hassince="20"/since="18"), so alerts 995-999 have nothing to match under the new model.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #263
Problem
The java-kotlin job of the CodeQL workflow runs with
build-mode: noneand sets up no JDK. CodeQL infers no JDK from the project (No specific JDK inferred from the project being analysed; using the java on the PATH), so it models the JDK API on the defaultjavaof the runner image. On 2026-10-19ubuntu-latestmoved from ubuntu-24.04 to ubuntu-26.04, and thatjavachanged from 17 to 25. Code scanning then opened alerts for APIs deprecated only after Java 17, the version the release is built with. The details are in #263.Fix
Initialize CodeQL, the java-kotlin job sets up the JDK that the release is built with, with theactions/setup-javaparameters ofrelease.yml: temurin, 8 onsustaining/6.3.xand 17 otherwise. The branch is taken fromgithub.base_reffor a pull request and fromgithub.ref_namefor a push.The other languages do not use the step. The same change for OpenDJ is OpenIdentityPlatform/OpenDJ#1232.
Test
The change only takes effect in a CodeQL run, so the CodeQL run of this PR is the test. The java-kotlin job log must show
Java version: 17...fromEclipse Adoptium, where master showsJava version: 25.0.4.1.A pull request analysis only reports results on the changed lines, so it cannot show the alerts going away. They are closed by the first analysis of master after the merge.