Analyze Kotlin with an advanced-setup CodeQL workflow

Merged
JE
2mo ago
+398-0

Problem

The Analyze (java-kotlin) CodeQL check fails on every push to main and every open pull request (example: run 34461894884). It comes from GitHub's CodeQL default setup (CODE_SCANNING_IS_STEADY_STATE_DEFAULT_SETUP: true in the job env; no workflow in the repository), which runs java-kotlin with build-mode: none:

Extracting Java with build-mode=none.
...
[autobuild] BUILD SUCCESSFUL in 45s            <- Gradle ran only as a classpath probe; nothing compiled
No specific JDK inferred from the project being analysed; using the java on the PATH
codeql database finalize --finalize-dataset ... /home/runner/work/_temp/codeql_databases/java
Error: CodeQL could not process any code written in Java/Kotlin.
##[error]... Exit code was 32

The buildless Java extractor only reads .java sources, and the repository's only Java (spec/smithy-bare-arrays) is disregarded as an out-of-scope project, so the database is empty. Proof that the Kotlin itself is analyzable: default setup's sibling "CodeQL - Code Quality" run on the same commit uses build-mode: autobuild, runs :fizzy-sdk:compileKotlinJvm, and passes. Default setup's build mode is not configurable.

Fix

Advanced setup, mirroring what basecamp-sdk already runs green:

  • .github/workflows/codeql.yml — build-mode: manual for Go, Kotlin and Swift, using the same toolchains and build commands as test.yml (Corretto 17 + setup-gradle + ./gradlew --no-build-cache clean :fizzy-sdk:compileKotlinJvm; go build ./...; swift build on macos-15). Buildless extraction for Actions, JavaScript/TypeScript, Ruby and Rust. Rust is new: it is the largest language in the repository and default setup was not scanning it. Every action is pinned by SHA with the org's pins (codeql-action v4.37.9 as in basecamp-sdk; the rest are this repo's existing pins). permissions: {} at the top, contents: read + security-events: write per job, persist-credentials: false on checkout.
  • .github/codeql/codeql-config.yml — security-and-quality, paths-ignore for generated code and test infrastructure.
  • .github/codeql/sarif-filter.jq + test-sarif-filter.sh + fixture — generated code enters the database for compiled languages via build tracing, so its alerts are stripped from the SARIF before upload (basecamp-sdk's filter with this repo's paths). Unlike basecamp-sdk, the test runs in the workflow, ahead of the filter step.

Categories keep default setup's names (/language:java-kotlin, /language:javascript-typescript, ...) so existing alerts carry over rather than being duplicated under new categories.

Default setup

GitHub rejects advanced-setup SARIF uploads while default setup is on, so it has been switched off already:

gh api -X PATCH repos/basecamp/fizzy-sdk/code-scanning/default-setup -f state=not-configured

(state now reads not-configured.) The failing default-setup checks stop appearing on open PRs from here on; this workflow takes over on merge.

Verification

  • ./.github/codeql/test-sarif-filter.sh passes; actionlint and zizmor 1.30.0 --persona regular are clean; pre-commit hooks pass.
  • make check does not read .github/; the Test workflow on this PR runs the same targets.
  • The CodeQL Advanced jobs on this PR are the real test (see checks).

Summary by cubic

Replaces the failing CodeQL default setup with an advanced workflow that builds Kotlin, Go, and Swift manually and adds Rust scanning.

  • Default setup ran java-kotlin with build-mode: none, producing an empty database and failing with exit code 32.
  • The new workflow uses build-mode: manual for Go, Kotlin, and Swift with the same toolchains as test.yml.
  • Adds Rust scanning, which default setup wasn't doing.
  • Generated-code alerts are stripped from SARIF before upload via a jq filter, with a regression test run in the workflow; the filter covers generated Go services while keeping hand-written *_service_test.go.
  • The SARIF upload is blocking, so a rejected upload surfaces credential or setup problems.
  • Alert categories match default setup's names so existing alerts carry over.
  • Default setup has been disabled; advanced-setup uploads require it to be off.