Skip to content

ci(codeql): make the java-kotlin analysis blocking again (closes #26) #180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
WolfTasks merged 1 commit into from
Oct 24, 2026
Merged

ci(codeql): make the java-kotlin analysis blocking again (closes #26) #180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 0 additions & 8 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,12 +14,6 @@ jobs:
permissions:
contents: read
security-events: write
# TEMPORARY: CodeQL's Kotlin extractor does not yet support Kotlin 2.4.0
# ("version too recent, supports below 2.3.30" — github/codeql#21938, fix PR #21970
# unreleased). The java-kotlin build + analyze steps are marked continue-on-error so
# the leg's check concludes success instead of blocking merges. Kotlin CodeQL scanning
# is effectively disabled until then; re-enable (drop the continue-on-error lines +
# bump codeql-action) per tracking issue #26. javascript-typescript stays fully enforced.
strategy:
fail-fast: false
matrix:
Expand All @@ -45,12 +39,10 @@ jobs:
ram: 8192
- name: Build backend for CodeQL
if: matrix.language == 'java-kotlin'
continue-on-error: true # temp: Kotlin 2.4.0 unsupported by CodeQL — see issue #26
run: |
chmod +x gradlew
./gradlew compileTestKotlin -x test --no-daemon
working-directory: backend
- uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
continue-on-error: ${{ matrix.language == 'java-kotlin' }} # temp: see issue #26
with:
category: "/language:${{ matrix.language }}"
9 changes: 5 additions & 4 deletions mkdocs/developer-guide/supply-chain-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,11 +63,12 @@ verwundbaren npm-Paketen die nächste Stufe erreicht.

### CodeQL (Workflow: `codeql.yml`)

GitHub CodeQL analysiert **Java/Kotlin** (Autobuild) und **JavaScript/TypeScript**
(kein separater Build nötig). Der Workflow läuft bei jedem Push und PR auf `main`
GitHub CodeQL analysiert **Java/Kotlin** (manueller Build: `./gradlew compileTestKotlin`) und
**JavaScript/TypeScript** (kein separater Build nötig). Der Workflow läuft bei jedem Push und PR auf `main`
sowie wöchentlich montags um 03:30 UTC. Findings werden als Code-Scanning-Alerts
im Security-Tab angezeigt. CodeQL blockt den Build nicht direkt, ist jedoch als
Required Status Check konfigurierbar.
im Security-Tab angezeigt. Beide `analyze`-Checks sind Required Status Checks der `main`-Ruleset; ein
Fehlschlag (z. B. eine Kotlin-Version, die der CodeQL-Extractor noch nicht kennt) blockt den Merge.
Dann `github/codeql-action` aktualisieren statt den Check abzuschwächen (vgl. Issue #26).

### gitleaks

Expand Down
Loading