From d06f08646bd3d7ea7ecdb9533f0de1093ea90e71 Mon Sep 17 00:00:00 2001
From: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Date: Sat, 24 Oct 2026 16:02:32 +0200
Subject: [PATCH] ci(codeql): make the java-kotlin analysis blocking again

CodeQL CLI 2.27.3 (codeql-action 4.39.0) extracts Kotlin 2.4.21: no
"Kotlin version too recent" error on main, and the uploaded java-kotlin
analysis carries a finding in a .kt file, so it analyses real Kotlin
code. Drop the temporary continue-on-error on the build and analyze
steps. Docs: manual build mode, both analyze checks are required.

Closes #26

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/codeql.yml                    | 8 --------
 mkdocs/developer-guide/supply-chain-security.md | 9 +++++----
 2 files changed, 5 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 32cd5c52..ca3f0944 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -14,12 +14,6 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    # TEMPORARY: CodeQL's Kotlin extractor does not yet support Kotlin 2.4.0
-    # ("version too recent, supports below 2.3.30" — github/codeql#21938, fix PR #21970
-    # unreleased). The java-kotlin build + analyze steps are marked continue-on-error so
-    # the leg's check concludes success instead of blocking merges. Kotlin CodeQL scanning
-    # is effectively disabled until then; re-enable (drop the continue-on-error lines +
-    # bump codeql-action) per tracking issue #26. javascript-typescript stays fully enforced.
     strategy:
       fail-fast: false
       matrix:
@@ -45,12 +39,10 @@ jobs:
           ram: 8192
       - name: Build backend for CodeQL
         if: matrix.language == 'java-kotlin'
-        continue-on-error: true   # temp: Kotlin 2.4.0 unsupported by CodeQL — see issue #26
         run: |
           chmod +x gradlew
           ./gradlew compileTestKotlin -x test --no-daemon
         working-directory: backend
       - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
-        continue-on-error: ${{ matrix.language == 'java-kotlin' }}   # temp: see issue #26
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/mkdocs/developer-guide/supply-chain-security.md b/mkdocs/developer-guide/supply-chain-security.md
index c8f01ea6..88b5d7f6 100644
--- a/mkdocs/developer-guide/supply-chain-security.md
+++ b/mkdocs/developer-guide/supply-chain-security.md
@@ -63,11 +63,12 @@ verwundbaren npm-Paketen die nächste Stufe erreicht.
 
 ### CodeQL (Workflow: `codeql.yml`)
 
-GitHub CodeQL analysiert **Java/Kotlin** (Autobuild) und **JavaScript/TypeScript**
-(kein separater Build nötig). Der Workflow läuft bei jedem Push und PR auf `main`
+GitHub CodeQL analysiert **Java/Kotlin** (manueller Build: `./gradlew compileTestKotlin`) und
+**JavaScript/TypeScript** (kein separater Build nötig). Der Workflow läuft bei jedem Push und PR auf `main`
 sowie wöchentlich montags um 03:30 UTC. Findings werden als Code-Scanning-Alerts
-im Security-Tab angezeigt. CodeQL blockt den Build nicht direkt, ist jedoch als
-Required Status Check konfigurierbar.
+im Security-Tab angezeigt. Beide `analyze`-Checks sind Required Status Checks der `main`-Ruleset; ein
+Fehlschlag (z. B. eine Kotlin-Version, die der CodeQL-Extractor noch nicht kennt) blockt den Merge.
+Dann `github/codeql-action` aktualisieren statt den Check abzuschwächen (vgl. Issue #26).
 
 ### gitleaks