[#1231] Set up the JDK of the release for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image

.github/workflows/build.yml

@@ -1056,7 +1056,7 @@ jobs:
           scanners: vuln
           cache: false
       - name: Upload Trivy report to GitHub Security
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         # upload even if a preceding step failed, but not without a report to upload
         if: ${{ always() && hashFiles('trivy-results.sarif') != '' }}
         with:

.github/workflows/codeql.yml

@@ -84,8 +84,22 @@ jobs:
         with:
           submodules: recursive
 
+      # With build-mode 'none' CodeQL infers no JDK from this project and
+      # models the JDK API on the java found on the PATH, so without this step
+      # the results follow the default JDK of the runner image: ubuntu-26.04
+      # brought JDK 25 and with it alerts for APIs deprecated only after
+      # Java 11. Pin the JDK and distribution the release is built with
+      # (release.yml): 8 on sustaining/4.10.x, 11 otherwise. It also serves
+      # the Java manual build below.
+      - name: Set up JDK
+        if: matrix.language == 'java-kotlin'
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ (github.base_ref || github.ref_name) == 'sustaining/4.10.x' && '8' || '11' }}
+          distribution: 'temurin'
+
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -118,12 +132,6 @@ jobs:
       # ---------------------------------------------------------------------
 
       # --- Java manual build (only used if the java entry is set to 'manual')
-      # - name: Set up JDK 11
-      #   if: matrix.language == 'java-kotlin'
-      #   uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
-      #   with:
-      #     java-version: '11'
-      #     distribution: 'zulu'
       # - name: Cache Maven packages
       #   if: matrix.language == 'java-kotlin'
       #   uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -139,6 +147,6 @@ jobs:
       # ---------------------------------------------------------------------
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/docker-scan.yml

@@ -51,7 +51,7 @@ jobs:
           scanners: vuln
           cache: false
       - name: Upload report to GitHub Security
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         # upload even if a preceding step failed, but not without a report to upload
         if: ${{ always() && hashFiles(format('trivy-{0}.sarif', matrix.tag)) != '' }}
         with: