From bccbc2fa9c6a73b1ff22f8cb8c6da674f4b93fc1 Mon Sep 17 00:00:00 2001 From: Alex Abashev Date: Sat, 26 Sep 2026 16:28:12 +0300 Subject: [PATCH] Analyze the Java code CodeQL sees compiled With build-mode none CodeQL scans every Java file in the checkout, and this repository keeps 54 of them in src/test/resources: the test projects the formatter runs on, which declare the same classes over and over (HelloWorld1 alone 26 times). The build step copied them once more into target/test-classes. CodeQL keeps one file per fully-qualified class name, so the main branch reported 104 clashing files filtered out and 23 of 73 Java files scanned. Java now uses build-mode manual: CodeQL analyzes what the existing `mvn clean test-compile` step compiles, which is the plugin's main and test sources and the generated HelpMojo. The test projects are copied as resources and never compiled, so none of them reaches the scan. The build step runs only for that leg; the actions leg keeps build-mode none and needs no Maven. --- .github/workflows/codeql-analysis.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 31e276a..6599573 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -22,8 +22,11 @@ jobs: include: - language: actions build-mode: none + # Manual: CodeQL analyzes what the build step below compiles, the plugin's main and test + # sources. The test projects in src/test/resources are Java files too, but javac never sees + # them, and with build-mode none their many copies of the same classes crowded the scan. - language: java-kotlin - build-mode: none + build-mode: manual steps: - name: Checkout repository @@ -42,6 +45,7 @@ jobs: build-mode: ${{ matrix.build-mode }} - name: Build main and test sources for CodeQL + if: ${{ matrix.build-mode == 'manual' }} run: mvn --no-transfer-progress -B clean test-compile - name: Perform CodeQL Analysis