CodeQL detected code written in Java/Kotlin but could not process any of it in Android Gradle project

[charEtoile]

Hi there,

I cannot create the CodeQL database for an Android Gradle project.
I tried on a starter project that I created under Android studio and which compiles without any problem.

Environment

➜  deleteme echo $JAVA_HOME
/Applications/Android Studio.app/Contents/jbr/Contents/Home

➜  deleteme /Users/charetoile/Developer/deleteme/gradlew --version

------------------------------------------------------------
Gradle 8.13
------------------------------------------------------------

Build time:    2025-02-25 09:22:14 UTC
Revision:      073314332697ba45c16c0a0ce1891fa6794179ff

Kotlin:        2.0.21
Groovy:        3.0.22
Ant:           Apache Ant(TM) version 1.10.15 compiled on August 25 2024
Launcher JVM:  21.0.6 (JetBrains s.r.o. 21.0.6+-13391695-b895.109)
Daemon JVM:    /Applications/Android Studio.app/Contents/jbr/Contents/Home (no JDK specified, using current Java home)
OS:            Mac OS X 15.6.1 aarch64

➜  deleteme codeql --version
CodeQL command-line toolchain release 2.23.5.
Copyright (C) 2019-2025 GitHub, Inc.
Unpacked in: /Users/charetoile/Developer/codeql
   Analysis results depend critically on separately distributed query and
   extractor modules. To list modules that are visible to the toolchain,
   use 'codeql resolve packs' and 'codeql resolve languages'.

CodeQL database create output

➜  deleteme codeql database create /Users/charetoile/Developer/codeql_databases/android-deleteme \
  --language=java \        
  --source-root=/Users/charetoile/Developer/deleteme/app/ \
  --command="/Users/charetoile/Developer/deleteme/gradlew clean assembleDebug --no-build-cache --no-daemon" --overwrite
Initializing database at /Users/charetoile/Developer/codeql_databases/android-deleteme.
Running build command: [/Users/charetoile/Developer/deleteme/gradlew, clean, assembleDebug, --no-build-cache, --no-daemon]
Running command in /Users/charetoile/Developer/deleteme/app: [/Users/charetoile/Developer/deleteme/gradlew, clean, assembleDebug, --no-build-cache, --no-daemon]
[2025-11-20 17:41:26] [build-stdout] To honour the JVM settings for this build a single-use Daemon process will be forked. For more on this, please refer to https://docs.gradle.org/8.13/userguide/gradle_daemon.html#sec:disabling_the_daemon in the Gradle documentation.
[2025-11-20 17:41:27] [build-stdout] Daemon will be stopped at the end of the build 
[2025-11-20 17:41:32] [build-stdout] > Task :app:clean UP-TO-DATE
[2025-11-20 17:41:32] [build-stdout] > Task :app:preBuild UP-TO-DATE
[2025-11-20 17:41:32] [build-stdout] > Task :app:preDebugBuild UP-TO-DATE
[2025-11-20 17:41:32] [build-stdout] > Task :app:mergeDebugNativeDebugMetadata NO-SOURCE
[2025-11-20 17:41:32] [build-stdout] > Task :app:checkKotlinGradlePluginConfigurationErrors SKIPPED
[2025-11-20 17:41:32] [build-stdout] > Task :app:generateDebugResValues
[2025-11-20 17:41:32] [build-stdout] > Task :app:dataBindingMergeDependencyArtifactsDebug
[2025-11-20 17:41:32] [build-stdout] > Task :app:generateDebugResources
[2025-11-20 17:41:34] [build-stdout] > Task :app:packageDebugResources
[2025-11-20 17:41:34] [build-stdout] > Task :app:mapDebugSourceSetPaths
[2025-11-20 17:41:34] [build-stdout] > Task :app:createDebugCompatibleScreenManifests
[2025-11-20 17:41:34] [build-stdout] > Task :app:parseDebugLocalResources
[2025-11-20 17:41:34] [build-stdout] > Task :app:extractDeepLinksDebug
[2025-11-20 17:41:34] [build-stdout] > Task :app:checkDebugAarMetadata
[2025-11-20 17:41:34] [build-stdout] > Task :app:mergeDebugResources
[2025-11-20 17:41:35] [build-stdout] > Task :app:processDebugMainManifest
[2025-11-20 17:41:35] [build-stdout] > Task :app:dataBindingGenBaseClassesDebug
[2025-11-20 17:41:35] [build-stdout] > Task :app:processDebugManifest
[2025-11-20 17:41:35] [build-stdout] > Task :app:javaPreCompileDebug
[2025-11-20 17:41:35] [build-stdout] > Task :app:mergeDebugShaders
[2025-11-20 17:41:35] [build-stdout] > Task :app:compileDebugShaders NO-SOURCE
[2025-11-20 17:41:35] [build-stdout] > Task :app:generateDebugAssets UP-TO-DATE
[2025-11-20 17:41:35] [build-stdout] > Task :app:mergeDebugAssets
[2025-11-20 17:41:35] [build-stdout] > Task :app:compressDebugAssets
[2025-11-20 17:41:35] [build-stdout] > Task :app:desugarDebugFileDependencies
[2025-11-20 17:41:35] [build-stdout] > Task :app:mergeDebugJniLibFolders
[2025-11-20 17:41:35] [build-stdout] > Task :app:mergeDebugNativeLibs NO-SOURCE
[2025-11-20 17:41:35] [build-stdout] > Task :app:stripDebugDebugSymbols NO-SOURCE
[2025-11-20 17:41:35] [build-stdout] > Task :app:validateSigningDebug
[2025-11-20 17:41:35] [build-stdout] > Task :app:writeDebugAppMetadata
[2025-11-20 17:41:35] [build-stdout] > Task :app:writeDebugSigningConfigVersions
[2025-11-20 17:41:35] [build-stdout] > Task :app:processDebugManifestForPackage
[2025-11-20 17:41:35] [build-stdout] > Task :app:checkDebugDuplicateClasses
[2025-11-20 17:41:36] [build-stdout] > Task :app:mergeLibDexDebug
[2025-11-20 17:41:37] [build-stdout] > Task :app:processDebugResources
[2025-11-20 17:41:38] [build-stdout] > Task :app:mergeExtDexDebug
[2025-11-20 17:41:39] [build-stdout] > Task :app:compileDebugKotlin
[2025-11-20 17:41:39] [build-stdout] > Task :app:compileDebugJavaWithJavac
[2025-11-20 17:41:39] [build-stdout] > Task :app:processDebugJavaRes
[2025-11-20 17:41:40] [build-stdout] > Task :app:dexBuilderDebug
[2025-11-20 17:41:40] [build-stdout] > Task :app:mergeProjectDexDebug
[2025-11-20 17:41:40] [build-stdout] > Task :app:mergeDebugJavaResource
[2025-11-20 17:41:40] [build-stdout] > Task :app:packageDebug
[2025-11-20 17:41:40] [build-stdout] > Task :app:createDebugApkListingFileRedirect
[2025-11-20 17:41:40] [build-stdout] > Task :app:assembleDebug
[2025-11-20 17:41:40] [build-stdout] BUILD SUCCESSFUL in 14s
[2025-11-20 17:41:40] [build-stdout] 36 actionable tasks: 35 executed, 1 up-to-date
Finalizing database at /Users/charetoile/Developer/codeql_databases/android-deleteme.
CodeQL detected code written in Java/Kotlin but could not process any of it. For more information, review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build.

CodeQL build-tracer.log

[T 16:41:23 79929] CodeQL CLI version 2.23.5
[T 16:41:23 79929] Initializing tracer.
[T 16:41:23 79929] Initializing tags.
[T 16:41:23 79929] ID set to 0000000000013839_0000000000000001 (parent root)
[T 16:41:23 79929] Initializing tracer.
[T 16:41:23 79929] Initializing tags.
[T 16:41:23 79929] ID set to 0000000000013839_0000000000000002 (parent root)
[T 16:41:23 79929] Warning: SEMMLE_EXEC and SEMMLE_EXECP not set. Falling back to path lookup on argv[0].
[T 16:41:23 79929] ==== Candidate to intercept: /Users/charetoile/Developer/codeql/tools/osx64/runner-osx (canonical: /Users/charetoile/Developer/codeql/tools/osx64/runner-osx) ====
[T 16:41:23 79929] Lua: === Intercepted call to /users/charetoile/developer/codeql/tools/osx64/runner-osx ===
[T 16:41:23 79929] Executing the following tracer actions:
[T 16:41:23 79929] Tracer actions:
[T 16:41:23 79929] pre_invocations(0)
[T 16:41:23 79929] post_invocations(0)
[T 16:41:23 79929] trace_languages(1): [java]
[T 16:41:23 79930] Attempting to switch stdout/stderr to 3...
/Users/charetoile/Developer/codeql_databases/android-deleteme/working/copy-root/000001F6/usr/bin/env.semmle.00013839.1042E338.slice.x86_64: replacing existing signature
[T 16:41:23 79929] Initializing tracer.
[T 16:41:23 79929] Initializing tags.
[T 16:41:23 79929] ID set to 0000000000013839_0000000000000003 (parent 0000000000013839_0000000000000002)
[T 16:41:23 79929] ==== Candidate to intercept: /Users/charetoile/Developer/MWS/wound-support-app/deleteme/gradlew (canonical: /Users/charetoile/Developer/MWS/wound-support-app/deleteme/gradlew) ====
[T 16:41:23 79929] Lua: === Intercepted call to /users/charetoile/developer/mws/wound-support-app/deleteme/gradlew ===
[T 16:41:23 79929] Executing the following tracer actions:
[T 16:41:23 79929] Tracer actions:
[T 16:41:23 79929] pre_invocations(0)
[T 16:41:23 79929] post_invocations(0)
[T 16:41:23 79929] trace_languages(1): [java]
[T 16:41:23 79941] Attempting to switch stdout/stderr to 3...
/Users/charetoile/Developer/codeql_databases/android-deleteme/working/copy-root/000001F6/bin/sh.semmle.00013839.2BF24268.slice.x86_64: replacing existing signature
[T 16:41:24 79929] Initializing tracer.
[T 16:41:24 79929] Initializing tags.
[T 16:41:24 79929] ID set to 0000000000013839_0000000000000004 (parent 0000000000013839_0000000000000003)
[T 16:41:24 79929] ==== Candidate to intercept: /bin/sh (canonical: /bin/sh) ====
[T 16:41:24 79929] Lua: === Intercepted call to /bin/sh ===
[T 16:41:24 79929] Executing the following tracer actions:
[T 16:41:24 79929] Tracer actions:
[T 16:41:24 79929] pre_invocations(0)
[T 16:41:24 79929] post_invocations(0)
[T 16:41:24 79929] trace_languages(1): [java]
[T 16:41:24 79946] Attempting to switch stdout/stderr to 3...
/Users/charetoile/Developer/codeql_databases/android-deleteme/working/copy-root/000001F6/bin/bash.semmle.00013839.08603DC8.slice.x86_64: replacing existing signature
[T 16:41:24 79929] Initializing tracer.
[T 16:41:24 79929] Initializing tags.
[T 16:41:24 79929] ID set to 0000000000013839_0000000000000005 (parent 0000000000013839_0000000000000004)
[T 16:41:24 79929] ==== Candidate to intercept: /bin/bash (canonical: /bin/bash) ====
[T 16:41:24 79929] Lua: === Intercepted call to /bin/bash ===
[T 16:41:24 79929] Executing the following tracer actions:
[T 16:41:24 79929] Tracer actions:
[T 16:41:24 79929] pre_invocations(0)
[T 16:41:24 79929] post_invocations(0)
[T 16:41:24 79929] trace_languages(1): [java]
[T 16:41:24 79954] Attempting to switch stdout/stderr to 3...
/Users/charetoile/Developer/codeql_databases/android-deleteme/working/copy-root/000001F6/usr/bin/dirname.semmle.00013851.23BDB438.slice.x86_64: replacing existing signature
[T 16:41:24 79953] Initializing tracer.
[T 16:41:24 79953] Initializing tags.
[T 16:41:24 79953] ID set to 0000000000013851_0000000000000001 (parent 0000000000013839_0000000000000005)
[T 16:41:24 79953] ==== Candidate to intercept: /usr/bin/dirname (canonical: /usr/bin/dirname) ====
[T 16:41:24 79953] Lua: === Intercepted call to /usr/bin/dirname ===
[T 16:41:25 79953] Executing the following tracer actions:
[T 16:41:25 79953] Tracer actions:
[T 16:41:25 79953] pre_invocations(0)
[T 16:41:25 79953] post_invocations(0)
[T 16:41:25 79953] trace_languages(1): [java]
[T 16:41:25 79961] Attempting to switch stdout/stderr to 3...
/Users/charetoile/Developer/codeql_databases/android-deleteme/working/copy-root/000001F6/usr/bin/basename.semmle.00013858.0132D6C8.slice.x86_64: replacing existing signature
[T 16:41:25 79960] Initializing tracer.
[T 16:41:25 79960] Initializing tags.
[T 16:41:25 79960] ID set to 0000000000013858_0000000000000001 (parent 0000000000013839_0000000000000005)
[T 16:41:25 79960] ==== Candidate to intercept: /usr/bin/basename (canonical: /usr/bin/basename) ====
[T 16:41:25 79960] Lua: === Intercepted call to /usr/bin/basename ===
[T 16:41:25 79960] Executing the following tracer actions:
[T 16:41:25 79960] Tracer actions:
[T 16:41:25 79960] pre_invocations(0)
[T 16:41:25 79960] post_invocations(0)
[T 16:41:25 79960] trace_languages(1): [java]
[T 16:41:25 79967] Attempting to switch stdout/stderr to 3...
/Users/charetoile/Developer/codeql_databases/android-deleteme/working/copy-root/000001F6/usr/bin/uname.semmle.0001385E.1A2F1060.slice.x86_64: replacing existing signature
[T 16:41:25 79966] Initializing tracer.
[T 16:41:25 79966] Initializing tags.
[T 16:41:25 79966] ID set to 000000000001385E_0000000000000001 (parent 0000000000013839_0000000000000005)
[T 16:41:25 79966] ==== Candidate to intercept: /usr/bin/uname (canonical: /usr/bin/uname) ====
[T 16:41:25 79966] Lua: === Intercepted call to /usr/bin/uname ===
[T 16:41:25 79966] Executing the following tracer actions:
[T 16:41:25 79966] Tracer actions:
[T 16:41:25 79966] pre_invocations(0)
[T 16:41:25 79966] post_invocations(0)
[T 16:41:25 79966] trace_languages(1): [java]
[T 16:41:25 79974] Attempting to switch stdout/stderr to 3...
/Users/charetoile/Developer/codeql_databases/android-deleteme/working/copy-root/000001F6/usr/bin/sed.semmle.00013865.32AC7920.slice.x86_64: replacing existing signature
[T 16:41:26 79973] Initializing tracer.
[T 16:41:26 79973] Initializing tags.
[T 16:41:26 79973] ID set to 0000000000013865_0000000000000001 (parent 0000000000013839_0000000000000005)
[T 16:41:26 79973] ==== Candidate to intercept: /usr/bin/sed (canonical: /usr/bin/sed) ====
[T 16:41:26 79973] Lua: === Intercepted call to /usr/bin/sed ===
[T 16:41:26 79973] Executing the following tracer actions:
[T 16:41:26 79973] Tracer actions:
[T 16:41:26 79973] pre_invocations(0)
[T 16:41:26 79973] post_invocations(0)
[T 16:41:26 79973] trace_languages(1): [java]
[T 16:41:26 79990] Initializing tracer.
[T 16:41:26 79990] Initializing tags.
[T 16:41:26 79990] ID set to 0000000000013876_0000000000000001 (parent 0000000000013839_0000000000000005)
[T 16:41:26 79990] ==== Candidate to intercept: /usr/bin/sed (canonical: /usr/bin/sed) ====
[T 16:41:26 79990] Lua: === Intercepted call to /usr/bin/sed ===
[T 16:41:26 79990] Executing the following tracer actions:
[T 16:41:26 79990] Tracer actions:
[T 16:41:26 79990] pre_invocations(0)
[T 16:41:26 79990] post_invocations(0)
[T 16:41:26 79990] trace_languages(1): [java]
[T 16:41:26 79996] Initializing tracer.
[T 16:41:26 79996] Initializing tags.
[T 16:41:26 79996] ID set to 000000000001387C_0000000000000001 (parent 0000000000013839_0000000000000005)
[T 16:41:26 79996] ==== Candidate to intercept: /usr/bin/sed (canonical: /usr/bin/sed) ====
[T 16:41:26 79996] Lua: === Intercepted call to /usr/bin/sed ===
[T 16:41:26 79996] Executing the following tracer actions:
[T 16:41:26 79996] Tracer actions:
[T 16:41:26 79996] pre_invocations(0)
[T 16:41:26 79996] post_invocations(0)
[T 16:41:26 79996] trace_languages(1): [java]
[T 16:41:26 80002] Initializing tracer.
[T 16:41:26 80002] Initializing tags.
[T 16:41:26 80002] ID set to 0000000000013882_0000000000000001 (parent 0000000000013839_0000000000000005)
[T 16:41:26 80002] ==== Candidate to intercept: /usr/bin/sed (canonical: /usr/bin/sed) ====
[T 16:41:26 80002] Lua: === Intercepted call to /usr/bin/sed ===
[T 16:41:26 80002] Executing the following tracer actions:
[T 16:41:26 80002] Tracer actions:
[T 16:41:26 80002] pre_invocations(0)
[T 16:41:26 80002] post_invocations(0)
[T 16:41:26 80002] trace_languages(1): [java]
[T 16:41:26 80003] Attempting to switch stdout/stderr to 3...
relocator: nothing to relocate for /Applications/Android Studio.app/Contents/jbr/Contents/Home/bin/java (no thin slices)

Notes:

• Same behavior if using --language=java-kotlin
• Same behavior if using --rerun-tasks

[charEtoile]

Damn ! I figured it out myself right after posting! Instead of using Android Studio's JAVA_HOME=/Applications/Android Studio.app/Contents/jbr/Contents/Home, I tried with another one that I installed with sdkman:

export JAVA_HOME="/Users/charetoile/.sdkman/candidates/java/21.0.9.fx-zulu"

The CodeQL creation now continues with

... <previous stuff>
Finalizing database at /Users/charetoile/Developer/codeql_databases/android-deleteme.
Running pre-finalize script /Users/charetoile/Developer/codeql/java/tools/pre-finalize.sh in /Users/charetoile/Developer/deleteme/app.
Running command in /Users/charetoile/Developer/deleteme/app: [/Users/charetoile/Developer/codeql/java/tools/pre-finalize.sh]
[2025-11-20 18:12:33] [build-stderr] Scanning for files in /Users/charetoile/Developer/deleteme/app...
[2025-11-20 18:12:33] [build-stderr] /Users/charetoile/Developer/codeql_databases/android-deleteme: Indexing files in in /Users/charetoile/Developer/deleteme/app...
[2025-11-20 18:12:33] [build-stderr] Running command in /Users/charetoile/Developer/deleteme/app: [/Users/charetoile/Developer/codeql/xml/tools/index-files.sh, /Users/charetoile/Developer/codeql_databases/android-deleteme/working/files-to-index8308885613269397469.list]
[2025-11-20 18:12:34] [build-stdout] [2025-11-20 18:12:34] [build-stdout] [2025-11-20 18:12:34] [XMLExtractor] Processed 183 files in 933 ms; produced 3507430 bytes of compressed TRAP
[2025-11-20 18:12:34] [build-stdout] [2025-11-20 18:12:34] [build-stdout] 18:12:34.725 [main] INFO com.semmle.cli.SimpleExtractor.Stats -- Processed 183 files in 933 ms; produced 3507430 bytes of compressed TRAP
[2025-11-20 18:12:35] [build-stderr] Scanning for files in /Users/charetoile/Developer/deleteme/app...
[2025-11-20 18:12:35] [build-stderr] /Users/charetoile/Developer/codeql_databases/android-deleteme: Indexing files in in /Users/charetoile/Developer/deleteme/app...
[2025-11-20 18:12:35] [build-stderr] Running command in /Users/charetoile/Developer/deleteme/app: [/Users/charetoile/Developer/codeql/properties/tools/index-files.sh, /Users/charetoile/Developer/codeql_databases/android-deleteme/working/files-to-index1811021033333716324.list]
[2025-11-20 18:12:35] [build-stdout] [2025-11-20 18:12:35] [build-stdout] [2025-11-20 18:12:35] [PropertiesExtractor] Processed 3 files in 31 ms; produced 0 bytes of compressed TRAP
Pre-finalize script /Users/charetoile/Developer/codeql/java/tools/pre-finalize.sh completed in 2649 ms.
Running TRAP import for CodeQL database at /Users/charetoile/Developer/codeql_databases/android-deleteme...
Importing TRAP files
Merging relations
Finished writing database (relations: 1.99 MiB; string pool: 4.78 MiB).
TRAP import complete (6.7s).
Finished zipping source archive (631.48 KiB).
Successfully created database at /Users/charetoile/Developer/codeql_databases/android-deleteme.

Anyway, it fails on another Android project. Maybe the JAVA_HOME is the track to follow.

[charEtoile]

I can close the ticket. The issue was:

My Android project is pure Kotlin, the task compileDebugJavaWithJavac showed NO-SOURCE.

After reading here and there how CodeQL works, I understand that it hooks into the compiler process while it's running:

1. Build Tracing: when I run codeql database create --command="...", CodeQL wraps my build command
2. Compiler Interception: CodeQL monitors which compiler processes start (javac, kotlinc, etc.)
3. Source Analysis: while the compiler reads source files, CodeQL:

• captures the source code being compiled
• extracts AST (Abstract Syntax Tree) structure
• records dependencies and data flow
• builds its queryable database

So, .. back to my NO-SOURCE problem: CodeQL's Java extractor saw nothing to analyze. I added gradle option compileDebugKotlin to force fresh kotlinc compilation that CodeQL can trace and it worked. I just added a simple analysis:

codeql database analyze /Users/charetoile/Developer/codeql_databases/android-project \
  --format=sarif-latest \
  --output=android-project-results.sarif \
  codeql/java-queries:codeql-suites/java-security-and-quality.qls