Skip to content

[#1231] Set up the JDK of the release for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image - #1232

Merged
vharseko merged 3 commits into
OpenIdentityPlatform:masterfrom
vharseko:fix/1231-codeql-jdk11
Oct 27, 2026
Merged

[#1231] Set up the JDK of the release for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image#1232
vharseko merged 3 commits into
OpenIdentityPlatform:masterfrom
vharseko:fix/1231-codeql-jdk11

Conversation

@vharseko

@vharseko vharseko commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Fixes #1231

Problem

The java-kotlin job of the CodeQL workflow runs with build-mode: none and sets up no JDK. CodeQL infers no JDK from the project (No specific JDK inferred from the project being analysed; using the java on the PATH), so it models the JDK API on the default java of the runner image. On 2026-10-19 ubuntu-latest moved from ubuntu-24.04 to ubuntu-26.04, and that java changed from 17 to 25. Without a change to the code, code scanning opened 20 java/deprecated-call alerts (1318–1337) for APIs deprecated in Java 18–21, so only after Java 11, the version the release is built with. The details are in #1231.

Fix

  • Before Initialize CodeQL, the java-kotlin job sets up the JDK that the release is built with. It uses the release.yml setup: temurin, 8 on sustaining/4.10.x and 11 otherwise, with the same actions/setup-java version (v6.1.0). CodeQL then models the API of the JDK the release is built with, and the alert set no longer changes when GitHub moves ubuntu-latest to a newer image. The branch is taken from github.base_ref for a pull request and from github.ref_name for a push.
  • The new step pins actions/setup-java to the commit SHA of v6.1.0, like every other action in these workflows. build.yml, deploy.yml and release.yml pin the same SHA since Bump the github-actions group with 4 updates #1234, so every workflow sets up its JDK with the same version.
  • github/codeql-action moves from v4.39.0, the pin of Bump the github-actions group with 4 updates #1234, to v4.39.1, its newest release, in codeql.yml, build.yml and docker-scan.yml, also pinned to a commit SHA. It brings the CodeQL bundle 2.27.3 instead of 2.27.2.
  • The commented-out copy of the same step in the Java manual build section is removed. If that build is turned on, the new step serves it.

The other languages (actions, ruby, c-cpp) do not use the step.

The JDK 11 model does not report these deprecations, but a removal would still show up. If a future JDK removes Subject.doAs, Runtime.runFinalization or JMXConnector.getMBeanServerConnection(Subject), the Build matrix fails to compile once that JDK is added.

Test

The change to codeql.yml only takes effect in a CodeQL run, so the CodeQL run of this PR is the test. The java-kotlin job log must show Java version: 11... for the temurin JDK that setup-java installs, where master shows Java version: 25.0.4.1. The first revision of this PR, with zulu 11, showed Java version: 11.0.32, vendor: Azul Systems, Inc. in run 39757355544.

The Build run of this PR runs codeql-action/upload-sarif v4.39.1 in the Trivy step of docker-test. docker-scan.yml only runs on its weekly schedule and by hand, so it first runs v4.39.1 after the merge.

A pull request analysis only reports results on the changed lines (pr-diff-range), so it cannot show the 20 alerts going away. They are closed by the first analysis of master after the merge. The master analysis of de42bdce8f has 368 results. That analysis also moves to the CodeQL bundle 2.27.3, so it may open or close alerts that have nothing to do with the JDK.

@vharseko vharseko added bug CI security Security fixes / CodeQL code-scanning alerts labels Oct 22, 2026
@vharseko
vharseko requested a review from maximthomas October 22, 2026 09:41
@vharseko vharseko changed the title [#1231] Set up JDK 11 for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image [#1231] Set up the JDK of the release for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image Oct 22, 2026
This was referenced Oct 22, 2026
Merged
Merged
Merged
Merged
Merged
maximthomas
maximthomas reviewed Oct 22, 2026
View reviewed changes
Comment thread .github/workflows/codeql.yml Outdated
# the Java manual build below.
- name: Set up JDK
if: matrix.language == 'java-kotlin'
uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1

@maximthomas maximthomas Oct 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest to use setup-java@v6 as for example in OpenAM and commons projects

Suggested change
uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
uses: actions/setup-java@v6

@vharseko vharseko Oct 22, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. The step keeps a SHA, since every uses: under .github/workflows in OpenDJ is pinned to a commit SHA with a # vX.Y.Z comment (#1073) and .github/dependabot.yml keeps those pins up to date. OpenAM and commons reference actions by tag, so the matching PRs there (OpenIdentityPlatform/OpenAM#1194, OpenIdentityPlatform/commons#379) use @v6 to follow those repositories.

v6 resolves to v6.1.0 now, so 39f1b75 moves the pin to v6.1.0 (b843ebf9) here and in build.yml, deploy.yml and release.yml, which were on v6.0.1. The analysis and the release still use the same setup-java. The same commit moves github/codeql-action from v4.38.3 to v4.39.1 in all workflows.

maximthomas
maximthomas approved these changes Oct 22, 2026
View reviewed changes

@maximthomas maximthomas left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

praise: The analysis JDK now comes from the workflow instead of the runner image, and the job log shows it.

  • Set up JDK (.github/workflows/codeql.yml:94-99) runs before Initialize CodeQL, only for java-kotlin, with the setup-java SHA de7274f0 (v6.0.1) that release.yml:58 uses.
  • The head's java-kotlin job logs Java version: 11.0.32.1, vendor: Eclipse Adoptium, while master's push run logs 25.0.4.1. Both log the same extractor decision, No specific JDK inferred from the project being analysed; using the java on the PATH, which is the mechanism the description states.

@vharseko
vharseko requested a review from maximthomas October 22, 2026 16:33
vharseko added a commit to OpenIdentityPlatform/commons that referenced this pull request Oct 22, 2026
@vharseko
[#378] Set up the JDK of the release for the CodeQL Java analysis, so…
a233ff0 
… that its results no longer follow the default JDK of the runner image (#379)

Fixes #378

### Problem

The java-kotlin job of the CodeQL workflow runs with `build-mode: none`
and sets up no JDK. CodeQL infers no JDK from the project (`No specific
JDK inferred from the project being analysed; using the java on the
PATH`), so it models the JDK API on the default `java` of the runner
image. On 2026-10-19 `ubuntu-latest` moved from ubuntu-24.04 to
ubuntu-26.04, and that `java` changed from 17 to 25. Code scanning then
opened alerts for APIs deprecated only after Java 11, the version the
release is built with. The details are in #378.

### Fix

- `build.yml`, `deploy.yml` and `release.yml` use
`actions/setup-java@v6`, as every workflow of OpenAM, OpenDJ, OpenICF
and OpenIDM does. Their inputs (`java-version`, `distribution`,
`server-id`, `server-username`, `server-password`) are the ones that
OpenAM deploys and releases with on v6. Its release of 2026-10-22 ran on
v6.
- `.github/dependabot.yml` is added, the same as in OpenDJ and OpenIDM:
one grouped pull request a week for the GitHub Actions updates, labelled
`ci` and `dependencies`. This repository had no Dependabot
configuration, which is why its actions fell behind.
- The three workflow files get the CDDL header that the workflows of
OpenDJ carry.
- Before `Initialize CodeQL`, the java-kotlin job sets up the JDK that
the release is built with, with the `actions/setup-java` parameters of
`release.yml`: temurin, 8 on `sustaining/2.4.x` and 11 otherwise. The
branch is taken from `github.base_ref` for a pull request and from
`github.ref_name` for a push.
- The commented-out JDK step of the manual build section is removed. If
that build is turned on, the new step serves it.
- The file gets the CDDL header that `codeql.yml` carries in the other
projects. It had none.

The other languages do not use the step. The same change for OpenDJ is
OpenIdentityPlatform/OpenDJ#1232.

### Test

The change only takes effect in a CodeQL run, so the CodeQL run of this
PR is the test. The java-kotlin job log must show `Java version: 11...`
from `Eclipse Adoptium`, where master shows `Java version: 25.0.4.1`.

A pull request analysis only reports results on the changed lines, so it
cannot show the alerts going away. They are closed by the first analysis
of master after the merge.
vharseko added a commit to OpenIdentityPlatform/OpenAM that referenced this pull request Oct 22, 2026
@vharseko
[#1193] Set up the JDK of the release for the CodeQL Java analysis, s…
98b9e1b 
…o that its results no longer follow the default JDK of the runner image (#1194)

Fixes #1193

### Problem

The java-kotlin job of the CodeQL workflow runs with `build-mode: none`
and sets up no JDK. CodeQL infers no JDK from the project (`No specific
JDK inferred from the project being analysed; using the java on the
PATH`), so it models the JDK API on the default `java` of the runner
image. On 2026-10-19 `ubuntu-latest` moved from ubuntu-24.04 to
ubuntu-26.04, and that `java` changed from 17 to 25. Code scanning then
opened alerts for APIs deprecated only after Java 11, the version the
release is built with. The details are in #1193.

### Fix

- `deploy.yml` and `release.yml` set up temurin instead of zulu, as the
deploy and release workflows of commons, OpenDJ, OpenICF, OpenIDM and
OpenIG do. `build.yml` stays on zulu, like the Build workflows of all of
them.
- The two workflow files get the CDDL header that the workflows of
OpenDJ carry.
- Before `Initialize CodeQL`, the java-kotlin job sets up the JDK that
the release is built with, with the `actions/setup-java` parameters of
`release.yml`: temurin, 8 on `sustaining/15.2.x` and 11 otherwise. The
branch is taken from `github.base_ref` for a pull request and from
`github.ref_name` for a push.
- The commented-out JDK step of the manual build section is removed. If
that build is turned on, the new step serves it.

The other languages do not use the step. The same change for OpenDJ is
OpenIdentityPlatform/OpenDJ#1232.

### Test

The change only takes effect in a CodeQL run, so the CodeQL run of this
PR is the test. The java-kotlin job log must show `Java version: 11...`
from `Eclipse Adoptium`, where master shows `Java version: 25.0.4.1`.

A pull request analysis only reports results on the changed lines, so it
cannot show the alerts going away. They are closed by the first analysis
of master after the merge.
@vharseko vharseko added the dependencies Pull requests that update a dependency file label Oct 22, 2026
vharseko added a commit to OpenIdentityPlatform/OpenIG that referenced this pull request Oct 22, 2026
@vharseko
[#188] Set up the JDK of the release for the CodeQL Java analysis, so…
25eca8d 
… that its results no longer follow the default JDK of the runner image (#189)

Fixes #188

### Problem

The java-kotlin job of the CodeQL workflow runs with `build-mode: none`
and sets up no JDK. CodeQL infers no JDK from the project (`No specific
JDK inferred from the project being analysed; using the java on the
PATH`), so it models the JDK API on the default `java` of the runner
image. On 2026-10-19 `ubuntu-latest` moved from ubuntu-24.04 to
ubuntu-26.04, and that `java` changed from 17 to 25. Code scanning then
opened alerts for APIs deprecated only after Java 11, the version the
release is built with. The details are in #188.

### Fix

- Before `Initialize CodeQL`, the java-kotlin job sets up the JDK that
the release is built with, with the `actions/setup-java` parameters of
`release.yml`: temurin, 8 on `sustaining/5.4.x` and 11 otherwise. The
branch is taken from `github.base_ref` for a pull request and from
`github.ref_name` for a push.
- The commented-out JDK step of the manual build section is removed. If
that build is turned on, the new step serves it.

The other languages do not use the step. The same change for OpenDJ is
OpenIdentityPlatform/OpenDJ#1232.

The alignment that #188 proposes first — `actions/setup-java@v6` in
`build.yml`, `deploy.yml` and `release.yml`, a `.github/dependabot.yml`
with weekly grouped GitHub Actions updates, and the CDDL header of the
workflow files — reached master with #170, so this PR no longer carries
it.

### Test

The change only takes effect in a CodeQL run, so the CodeQL run of this
PR is the test. The java-kotlin job log must show `Java version: 11...`
from `Eclipse Adoptium`, where master shows `Java version: 25.0.4.1`.

A pull request analysis only reports results on the changed lines, so it
cannot show the alerts going away. They are closed by the first analysis
of master after the merge.
maximthomas
maximthomas approved these changes Oct 23, 2026
View reviewed changes

@maximthomas maximthomas left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

praise: The JDK the CodeQL Java analysis models is now set by the workflow, not by the runner image.

  • The Set up JDK step sits before Initialize CodeQL (.github/workflows/codeql.yml:94-99), and the java-kotlin job of this head logs Java version: 11.0.32.1. Master's analysis of de42bdce8f logs 25.0.4.1.
  • CodeQL now bases its Maven settings on the ~/.m2/settings.xml that setup-java writes, and the dependency graph is unchanged: 198 classpath entries, the same as master's analysis.
  • The setup-java and codeql-action pins move together in all five workflows, each pinned to a commit SHA.

@vharseko
[OpenIdentityPlatform#1231] Set up JDK 11 for the CodeQL Java analysi…
13dab90 
…s, so that its results no longer follow the default JDK of the runner image

Fixes OpenIdentityPlatform#1231

With build-mode 'none' CodeQL infers no JDK from the project and models
the JDK API on the java found on the PATH. When ubuntu-latest moved to
ubuntu-26.04 on 2026-10-19 that java became 25 instead of 17, and code
scanning opened 20 java/deprecated-call alerts (1318-1337) for APIs that
have no replacement in Java 11, without a change to the code.

The java-kotlin job now sets up zulu 11, the JDK the code is compiled
for, with the actions/setup-java version of the Build workflow, before
Initialize CodeQL. The commented-out copy of that step in the Java manual
build is gone, since the step now serves it too.
@vharseko
[OpenIdentityPlatform#1231] Take the JDK of the CodeQL Java analysis …
f3b6fcf 
…from the release: temurin, 8 on sustaining/4.10.x and 11 otherwise

The first revision set up zulu 11, as the Build workflow does. The release
is built with temurin, and with 8 on sustaining/4.10.x (release.yml), so
the analysis now uses the same setup-java parameters.
@vharseko
[OpenIdentityPlatform#1231] Move setup-java of the CodeQL step to v6.…
9a1113d 
…1.0 and codeql-action to v4.39.1

The review suggested the moving v6 tag for the new CodeQL step. Every
action in these workflows is pinned to a commit SHA, so the step keeps a
SHA, and the SHA moves from v6.0.1 to v6.1.0, the release v6 resolves
to, which build.yml, deploy.yml and release.yml pin since PR OpenIdentityPlatform#1234. The
CodeQL analysis and the release still set up their JDK with the same
setup-java.

github/codeql-action moves from v4.39.0, the pin of PR OpenIdentityPlatform#1234, to
v4.39.1, its newest release, in codeql.yml, build.yml and
docker-scan.yml. It brings the CodeQL bundle 2.27.3 instead of 2.27.2.
The pin is the commit that the annotated tag points to, not the tag
object.
@vharseko
vharseko force-pushed the fix/1231-codeql-jdk11 branch from 39f1b75 to 9a1113d Compare October 27, 2026 07:42
@vharseko
vharseko merged commit d3fecb7 into OpenIdentityPlatform:master Oct 27, 2026
14 checks passed
@vharseko
vharseko deleted the fix/1231-codeql-jdk11 branch October 27, 2026 07:45
vharseko added a commit to OpenIdentityPlatform/OpenICF that referenced this pull request Oct 27, 2026
@vharseko
[#201] Set up the JDK of the release for the CodeQL Java analysis, so…
82ccf7a 
… that its results no longer follow the default JDK of the runner image (#202)

Fixes #201

### Problem

The java-kotlin job of the CodeQL workflow runs with `build-mode: none`
and sets up no JDK. CodeQL infers no JDK from the project (`No specific
JDK inferred from the project being analysed; using the java on the
PATH`), so it models the JDK API on the default `java` of the runner
image. On 2026-10-19 `ubuntu-latest` moved from ubuntu-24.04 to
ubuntu-26.04, and that `java` changed from 17 to 25. Code scanning then
opened alerts for APIs deprecated only after Java 11, the version the
release is built with. The details are in #201.

### Fix

- `.github/dependabot.yml` labels the github-actions pull requests `ci`
and `dependencies`, as in OpenAM, OpenDJ and OpenIDM.
- Before `Initialize CodeQL`, the java-kotlin job sets up the JDK that
the release is built with, with the `actions/setup-java` parameters of
`release.yml`: temurin, 8 on `sustaining/1.8.x` and 11 otherwise. The
branch is taken from `github.base_ref` for a pull request and from
`github.ref_name` for a push.
- The commented-out JDK step of the manual build section is removed. If
that build is turned on, the new step serves it.

The other languages do not use the step. The same change for OpenDJ is
OpenIdentityPlatform/OpenDJ#1232.

### Test

The change only takes effect in a CodeQL run, so the CodeQL run of this
PR is the test. The java-kotlin job log must show `Java version: 11...`
from `Eclipse Adoptium`, where master shows `Java version: 25.0.4.1`.

A pull request analysis only reports results on the changed lines, so it
cannot show the alerts going away. They are closed by the first analysis
of master after the merge.
vharseko added a commit to OpenIdentityPlatform/OpenIDM that referenced this pull request Oct 28, 2026
@vharseko
[#263] Set up the JDK of the release for the CodeQL Java analysis, so…
d3d5567 
… that its results no longer follow the default JDK of the runner image (#264)

Fixes #263

### Problem

The java-kotlin job of the CodeQL workflow runs with `build-mode: none`
and sets up no JDK. CodeQL infers no JDK from the project (`No specific
JDK inferred from the project being analysed; using the java on the
PATH`), so it models the JDK API on the default `java` of the runner
image. On 2026-10-19 `ubuntu-latest` moved from ubuntu-24.04 to
ubuntu-26.04, and that `java` changed from 17 to 25. Code scanning then
opened alerts for APIs deprecated only after Java 17, the version the
release is built with. The details are in #263.

### Fix

- Before `Initialize CodeQL`, the java-kotlin job sets up the JDK that
the release is built with, with the `actions/setup-java` parameters of
`release.yml`: temurin, 8 on `sustaining/6.3.x` and 17 otherwise. The
branch is taken from `github.base_ref` for a pull request and from
`github.ref_name` for a push.

The other languages do not use the step. The same change for OpenDJ is
OpenIdentityPlatform/OpenDJ#1232.

### Test

The change only takes effect in a CodeQL run, so the CodeQL run of this
PR is the test. The java-kotlin job log must show `Java version: 17...`
from `Eclipse Adoptium`, where master shows `Java version: 25.0.4.1`.

A pull request analysis only reports results on the changed lines, so it
cannot show the alerts going away. They are closed by the first analysis
of master after the merge.


### Also in this PR: the OpenDJ wait of the usecase smoke tests

The run of this PR failed all four `ui-smoke-tests (…,
samples/usecase/usecase1)` legs with `OpenDJ did not start`. The cause
has nothing to do with CodeQL. On 2026-10-21
`openidentityplatform/opendj:latest` moved to 5.2.0. Its `run.sh` no
longer logs `OpenDJ is started`, the line the `Start OpenDJ for usecase
samples` step waited for, although the server came up (`The Directory
Server has started successfully`). Every usecase run fails the same way
now, master included.

The step now waits up to 5 minutes for the health status `healthy` of
the container, the same check `build-docker` uses for the OpenIDM image.
In 5.2.0 `healthy` means the bootstrap is complete (the LDIF is imported
and the server is started again) and LDAPS answers. The 5 minutes match
the `--start-period` of the image's `HEALTHCHECK`.

Checked locally with `opendj:latest` (5.2.0) and the arguments of the
workflow: the wait ends on `healthy`, and a bind as `cn=Directory
Manager` on 1389 finds the 33 entries of `hr_data.ldif`.

The failed `build-docker` of the same run (an empty image tag from an
anonymous call to the releases API) is fixed separately in #265.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@maximthomas maximthomas maximthomas approved these changes

Assignees

No one assigned

Labels

bug CI dependencies Pull requests that update a dependency file security Security fixes / CodeQL code-scanning alerts

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

CodeQL: the Java analysis takes its JDK from the runner image, and ubuntu-26.04 opened 20 deprecated-call alerts without a code change

2 participants

@vharseko @maximthomas