Repository navigation
[#378] Set up the JDK of the release for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image - #379
Merged
vharseko merged 2 commits intoOct 22, 2026
Conversation
…w and have Dependabot keep the actions up to date, as in the other projects build.yml, deploy.yml and release.yml still used actions/setup-java@v5. OpenAM, OpenDJ, OpenICF and OpenIDM use v6 in every workflow, because Dependabot updates their actions, and this repository had no Dependabot configuration. The inputs used here (java-version, distribution, server-id, server-username, server-password) are the ones OpenAM deploys and releases with on v6. .github/dependabot.yml now asks for one grouped pull request a week for the GitHub Actions updates, labelled ci and dependencies, as in OpenDJ and OpenIDM. The three workflow files get the CDDL header that the workflows of OpenDJ carry.
…QL Java analysis, so that its results no longer follow the default JDK of the runner image Fixes OpenIdentityPlatform#378 With build-mode 'none' CodeQL infers no JDK from the project and models the JDK API on the java found on the PATH. When ubuntu-latest moved to ubuntu-26.04 on 2026-10-19 that java became 25 instead of 17, and code scanning opened alerts for APIs deprecated only after Java 11, the version the release is built with. The java-kotlin job now sets up the JDK of the release before Initialize CodeQL, with the setup-java parameters of release.yml: temurin, 8 on sustaining/2.4.x and 11 otherwise. The commented-out JDK step of the manual build is gone, since the step now serves it too. The file gets the CDDL header that codeql.yml carries in the other projects.
vharseko
added
bug
dependencies
maximthomas
reviewed
Oct 22, 2026
maximthomas
left a comment
maximthomas
left a comment
Contributor
There was a problem hiding this comment.
praise: The analysis JDK now comes from the workflow instead of the runner image, and the job log shows it.
Set up JDK(.github/workflows/codeql.yml:82-87) runs beforeInitialize CodeQL, only forjava-kotlin, with the temurin distribution ofrelease.ymlanddeploy.yml.- This PR's java-kotlin job logs
Resolved Java 11.0.32+1 from tool-cacheandJava version: 11.0.32.1, vendor: Eclipse Adoptium, while master's push run (0aa455b) logs25.0.4.1. Both logNo specific JDK inferred from the project being analysed; using the java on the PATH, which is the mechanism the description states.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #378
Problem
The java-kotlin job of the CodeQL workflow runs with
build-mode: noneand sets up no JDK. CodeQL infers no JDK from the project (No specific JDK inferred from the project being analysed; using the java on the PATH), so it models the JDK API on the defaultjavaof the runner image. On 2026-10-19ubuntu-latestmoved from ubuntu-24.04 to ubuntu-26.04, and thatjavachanged from 17 to 25. Code scanning then opened alerts for APIs deprecated only after Java 11, the version the release is built with. The details are in #378.Fix
build.yml,deploy.ymlandrelease.ymluseactions/setup-java@v6, as every workflow of OpenAM, OpenDJ, OpenICF and OpenIDM does. Their inputs (java-version,distribution,server-id,server-username,server-password) are the ones that OpenAM deploys and releases with on v6. Its release of 2026-10-22 ran on v6..github/dependabot.ymlis added, the same as in OpenDJ and OpenIDM: one grouped pull request a week for the GitHub Actions updates, labelledcianddependencies. This repository had no Dependabot configuration, which is why its actions fell behind.Initialize CodeQL, the java-kotlin job sets up the JDK that the release is built with, with theactions/setup-javaparameters ofrelease.yml: temurin, 8 onsustaining/2.4.xand 11 otherwise. The branch is taken fromgithub.base_reffor a pull request and fromgithub.ref_namefor a push.codeql.ymlcarries in the other projects. It had none.The other languages do not use the step. The same change for OpenDJ is OpenIdentityPlatform/OpenDJ#1232.
Test
The change only takes effect in a CodeQL run, so the CodeQL run of this PR is the test. The java-kotlin job log must show
Java version: 11...fromEclipse Adoptium, where master showsJava version: 25.0.4.1.A pull request analysis only reports results on the changed lines, so it cannot show the alerts going away. They are closed by the first analysis of master after the merge.