From 13dab90f1b7d1ca93c287d727696922e1a90f79a Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Thu, 22 Oct 2026 12:40:41 +0300 Subject: [PATCH 1/3] [#1231] Set up JDK 11 for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image Fixes #1231 With build-mode 'none' CodeQL infers no JDK from the project and models the JDK API on the java found on the PATH. When ubuntu-latest moved to ubuntu-26.04 on 2026-10-19 that java became 25 instead of 17, and code scanning opened 20 java/deprecated-call alerts (1318-1337) for APIs that have no replacement in Java 11, without a change to the code. The java-kotlin job now sets up zulu 11, the JDK the code is compiled for, with the actions/setup-java version of the Build workflow, before Initialize CodeQL. The commented-out copy of that step in the Java manual build is gone, since the step now serves it too. --- .github/workflows/codeql.yml | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2b1b74bd82..1409ce24f7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -84,6 +84,20 @@ jobs: with: submodules: recursive + # With build-mode 'none' CodeQL infers no JDK from this project and + # models the JDK API on the java found on the PATH, so without this step + # the results follow the default JDK of the runner image: ubuntu-26.04 + # brought JDK 25 and with it deprecation alerts for APIs that have no + # replacement in Java 11. Pin the JDK the code is compiled for + # (maven.compiler.source/target 11), from the same distribution as the + # Build workflow. It also serves the Java manual build below. + - name: Set up JDK 11 + if: matrix.language == 'java-kotlin' + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + with: + java-version: '11' + distribution: 'zulu' + - name: Initialize CodeQL uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: @@ -118,12 +132,6 @@ jobs: # --------------------------------------------------------------------- # --- Java manual build (only used if the java entry is set to 'manual') - # - name: Set up JDK 11 - # if: matrix.language == 'java-kotlin' - # uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 - # with: - # java-version: '11' - # distribution: 'zulu' # - name: Cache Maven packages # if: matrix.language == 'java-kotlin' # uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 From f3b6fcfb3ab0ebdd0a0d8a6cb2002f08982bad00 Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Thu, 22 Oct 2026 13:23:24 +0300 Subject: [PATCH 2/3] [#1231] Take the JDK of the CodeQL Java analysis from the release: temurin, 8 on sustaining/4.10.x and 11 otherwise The first revision set up zulu 11, as the Build workflow does. The release is built with temurin, and with 8 on sustaining/4.10.x (release.yml), so the analysis now uses the same setup-java parameters. --- .github/workflows/codeql.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1409ce24f7..c10b7d06f0 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -87,16 +87,16 @@ jobs: # With build-mode 'none' CodeQL infers no JDK from this project and # models the JDK API on the java found on the PATH, so without this step # the results follow the default JDK of the runner image: ubuntu-26.04 - # brought JDK 25 and with it deprecation alerts for APIs that have no - # replacement in Java 11. Pin the JDK the code is compiled for - # (maven.compiler.source/target 11), from the same distribution as the - # Build workflow. It also serves the Java manual build below. - - name: Set up JDK 11 + # brought JDK 25 and with it alerts for APIs deprecated only after + # Java 11. Pin the JDK and distribution the release is built with + # (release.yml): 8 on sustaining/4.10.x, 11 otherwise. It also serves + # the Java manual build below. + - name: Set up JDK if: matrix.language == 'java-kotlin' uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: - java-version: '11' - distribution: 'zulu' + java-version: ${{ (github.base_ref || github.ref_name) == 'sustaining/4.10.x' && '8' || '11' }} + distribution: 'temurin' - name: Initialize CodeQL uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 From 9a1113d375532c68cf6c7d2b310473492977c00a Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Thu, 22 Oct 2026 19:31:15 +0300 Subject: [PATCH 3/3] [#1231] Move setup-java of the CodeQL step to v6.1.0 and codeql-action to v4.39.1 The review suggested the moving v6 tag for the new CodeQL step. Every action in these workflows is pinned to a commit SHA, so the step keeps a SHA, and the SHA moves from v6.0.1 to v6.1.0, the release v6 resolves to, which build.yml, deploy.yml and release.yml pin since PR #1234. The CodeQL analysis and the release still set up their JDK with the same setup-java. github/codeql-action moves from v4.39.0, the pin of PR #1234, to v4.39.1, its newest release, in codeql.yml, build.yml and docker-scan.yml. It brings the CodeQL bundle 2.27.3 instead of 2.27.2. The pin is the commit that the annotated tag points to, not the tag object. --- .github/workflows/build.yml | 2 +- .github/workflows/codeql.yml | 6 +++--- .github/workflows/docker-scan.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c532911a41..af01eedae0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1056,7 +1056,7 @@ jobs: scanners: vuln cache: false - name: Upload Trivy report to GitHub Security - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 # upload even if a preceding step failed, but not without a report to upload if: ${{ always() && hashFiles('trivy-results.sarif') != '' }} with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c10b7d06f0..9a154e666d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -93,13 +93,13 @@ jobs: # the Java manual build below. - name: Set up JDK if: matrix.language == 'java-kotlin' - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: java-version: ${{ (github.base_ref || github.ref_name) == 'sustaining/4.10.x' && '8' || '11' }} distribution: 'temurin' - name: Initialize CodeQL - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -147,6 +147,6 @@ jobs: # --------------------------------------------------------------------- - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/docker-scan.yml b/.github/workflows/docker-scan.yml index 7e691f40e8..f319ac3784 100644 --- a/.github/workflows/docker-scan.yml +++ b/.github/workflows/docker-scan.yml @@ -51,7 +51,7 @@ jobs: scanners: vuln cache: false - name: Upload report to GitHub Security - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 # upload even if a preceding step failed, but not without a report to upload if: ${{ always() && hashFiles(format('trivy-{0}.sarif', matrix.tag)) != '' }} with: