ci: switch CodeQL java-kotlin analysis to manual build mode

[khemssharma]

Problem

The Analyze (java-kotlin) CodeQL job was failing on master with:

Error: We were unable to automatically build your code. Please replace the call to the autobuild
action with your custom build steps... A fatal error occurred: Exit status 1 from command:
[.../codeql/java/tools/autobuild.sh]

CodeQL's autobuild mode tried to run ./gradlew ... testClasses under its build tracer, and the
Kotlin compiler crashed partway through (see the failed run: Push on master #148). Autobuild's
heuristics aren't a great fit for this multi-module Gradle/Kotlin build.

Fix

This adds an advanced CodeQL workflow (.github/workflows/codeql.yml) that switches the
java-kotlin language from build-mode: autobuild to build-mode: manual, and builds the
project ourselves:

• Installs Temurin JDK 25 via actions/setup-java, matching the JDK used to run Gradle in
  test.yml (jdkBuildVersion=25).
• Runs ./gradlew --no-daemon -PjdkBuildVersion=25 -Dorg.gradle.java.installations.auto-download=false testClasses
  directly as the manual build step, so CodeQL traces our own build instead of autobuild's
  heuristics.
• Leaves javascript-typescript on build-mode: none (no build required), unchanged.

Verification

Pushed this change to my fork and confirmed the workflow now completes successfully end to end:
JDK setup, the full Gradle build (all modules compile with only javadoc/lint warnings, no errors),
and the CodeQL analyze step, which finalizes the database and runs all Java queries. Both matrix
jobs (java-kotlin and javascript-typescript) finished with status Success in ~8.5 minutes.

Summary by CodeRabbit

• Chores
  • Added automated security analysis to help identify potential vulnerabilities in the application.
  • Security checks run automatically on code updates, pull requests, and a weekly schedule.
  • Analysis covers Java, Kotlin, JavaScript, and TypeScript code.
  • Java and Kotlin checks include a build validation step to improve scan accuracy.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 46e76132-2bca-4732-80e6-6f05dd73ab46

📥 Commits

Reviewing files that changed from the base of the PR and between 532498b and f65db9e.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

---

📝 Walkthrough

Walkthrough

The pull request adds a GitHub Actions CodeQL workflow for Java/Kotlin and JavaScript/TypeScript. It configures event and schedule triggers, language-specific build modes, Java setup, Gradle compilation, and analysis result categories.

Changes

CodeQL analysis

Layer / File(s)	Summary
Workflow triggers and analysis matrix .github/workflows/codeql.yml	The workflow runs on master pushes, pull requests, and a weekly schedule. The job defines permissions, languages, and build modes.
Language-specific analysis execution .github/workflows/codeql.yml	The workflow checks out the repository, installs Temurin JDK 25 for manual builds, initializes CodeQL, runs testClasses, and performs analysis with language-specific result categories.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: krmahadevan, juherr

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change to CodeQL Java/Kotlin analysis.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/codeql.yml:
- Around line 42-43: Update the actions/checkout step in the CodeQL workflow to
set persist-credentials to false before the Gradle build, unless a later
workflow step explicitly requires authenticated Git access.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a3de5be9-fcad-4bb7-b12a-278303ecea3a

📥 Commits

Reviewing files that changed from the base of the PR and between 4d59160 and 6adf7ea.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

[juherr]

Pin the sha1 and set version in a comment at the end of the line

[khemssharma]

Done! Pinned to the SHA (f205ea1c3313d32999d8d6a48b4f6530d4437b38) with the v4.37.4 version as a trailing comment in 532498b.

[juherr]

Pin sha1 on all actions.
Check coderabbit comments.

[juherr]

Why swift here?

[juherr]

Thanks for the fix