From d3fecb7575a9e9e4401774167c6816198eac46d7 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Tue, 27 Oct 2026 07:45:00 +0000
Subject: [PATCH] [#1231] Set up the JDK of the release for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image (#1232)
---
.github/workflows/docker-scan.yml | 2 +-
.github/workflows/codeql.yml | 24 ++++++++++++++++--------
.github/workflows/build.yml | 2 +-
3 files changed, 18 insertions(+), 10 deletions(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c532911..af01eed 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1056,7 +1056,7 @@
scanners: vuln
cache: false
- name: Upload Trivy report to GitHub Security
- uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+ uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
# upload even if a preceding step failed, but not without a report to upload
if: ${{ always() && hashFiles('trivy-results.sarif') != '' }}
with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2b1b74b..9a154e6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -84,8 +84,22 @@
with:
submodules: recursive
+ # With build-mode 'none' CodeQL infers no JDK from this project and
+ # models the JDK API on the java found on the PATH, so without this step
+ # the results follow the default JDK of the runner image: ubuntu-26.04
+ # brought JDK 25 and with it alerts for APIs deprecated only after
+ # Java 11. Pin the JDK and distribution the release is built with
+ # (release.yml): 8 on sustaining/4.10.x, 11 otherwise. It also serves
+ # the Java manual build below.
+ - name: Set up JDK
+ if: matrix.language == 'java-kotlin'
+ uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+ with:
+ java-version: ${{ (github.base_ref || github.ref_name) == 'sustaining/4.10.x' && '8' || '11' }}
+ distribution: 'temurin'
+
- name: Initialize CodeQL
- uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+ uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
@@ -118,12 +132,6 @@
# ---------------------------------------------------------------------
# --- Java manual build (only used if the java entry is set to 'manual')
- # - name: Set up JDK 11
- # if: matrix.language == 'java-kotlin'
- # uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
- # with:
- # java-version: '11'
- # distribution: 'zulu'
# - name: Cache Maven packages
# if: matrix.language == 'java-kotlin'
# uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -139,6 +147,6 @@
# ---------------------------------------------------------------------
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+ uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
with:
category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/docker-scan.yml b/.github/workflows/docker-scan.yml
index 7e691f4..f319ac3 100644
--- a/.github/workflows/docker-scan.yml
+++ b/.github/workflows/docker-scan.yml
@@ -51,7 +51,7 @@
scanners: vuln
cache: false
- name: Upload report to GitHub Security
- uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+ uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
# upload even if a preceding step failed, but not without a report to upload
if: ${{ always() && hashFiles(format('trivy-{0}.sarif', matrix.tag)) != '' }}
with:
--
Gitblit v1.10.0