Repository navigation
[#188] Set up the JDK of the release for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image - #189
Merged
vharseko merged 1 commit intoOct 22, 2026
Conversation
vharseko
added
bug
dependencies
maximthomas
approved these changes
Oct 22, 2026
maximthomas
left a comment
maximthomas
left a comment
Contributor
There was a problem hiding this comment.
praise: The fix is in the right place, and the PR's own test criterion holds.
.github/workflows/codeql.yml:80-85sets up Temurin beforeInitialize CodeQL. The PR'sAnalyze (java-kotlin)log shows "Setting Java 11.0.32+1 as the default", then "No specific JDK inferred from the project being analysed; using the java on the PATH" andJava version: 11.0.32.1, vendor: Eclipse Adoptium. The JDK API model is now 11, not the image's 25.(github.base_ref || github.ref_name)handles both pull_request runs (base branch) and push/schedule/dispatch runs (ref) in one expression.
…QL Java analysis, so that its results no longer follow the default JDK of the runner image Fixes OpenIdentityPlatform#188 With build-mode 'none' CodeQL infers no JDK from the project and models the JDK API on the java found on the PATH. When ubuntu-latest moved to ubuntu-26.04 on 2026-10-19 that java became 25 instead of 17, and code scanning opened alerts for APIs deprecated only after Java 11, the version the release is built with. The java-kotlin job now sets up the JDK of the release before Initialize CodeQL, with the setup-java parameters of release.yml: temurin, 8 on sustaining/5.4.x and 11 otherwise. The commented-out JDK step of the manual build is gone, since the step now serves it too.
vharseko
force-pushed
the
fix/188-codeql-jdk
branch
from
October 22, 2026 17:34
bf88659 to
0f47432
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #188
Problem
The java-kotlin job of the CodeQL workflow runs with
build-mode: noneand sets up no JDK. CodeQL infers no JDK from the project (No specific JDK inferred from the project being analysed; using the java on the PATH), so it models the JDK API on the defaultjavaof the runner image. On 2026-10-19ubuntu-latestmoved from ubuntu-24.04 to ubuntu-26.04, and thatjavachanged from 17 to 25. Code scanning then opened alerts for APIs deprecated only after Java 11, the version the release is built with. The details are in #188.Fix
Initialize CodeQL, the java-kotlin job sets up the JDK that the release is built with, with theactions/setup-javaparameters ofrelease.yml: temurin, 8 onsustaining/5.4.xand 11 otherwise. The branch is taken fromgithub.base_reffor a pull request and fromgithub.ref_namefor a push.The other languages do not use the step. The same change for OpenDJ is OpenIdentityPlatform/OpenDJ#1232.
The alignment that #188 proposes first —
actions/setup-java@v6inbuild.yml,deploy.ymlandrelease.yml, a.github/dependabot.ymlwith weekly grouped GitHub Actions updates, and the CDDL header of the workflow files — reached master with #170, so this PR no longer carries it.Test
The change only takes effect in a CodeQL run, so the CodeQL run of this PR is the test. The java-kotlin job log must show
Java version: 11...fromEclipse Adoptium, where master showsJava version: 25.0.4.1.A pull request analysis only reports results on the changed lines, so it cannot show the alerts going away. They are closed by the first analysis of master after the merge.