ci(codeql): enable Java (java-kotlin) analysis#274
Conversation
Add java-kotlin to the CodeQL matrix with build-mode none. Java supports buildless extraction, so it scans on PRs like rust without a Bazel/Maven build. Trigger on *.java changes as well. The monorepo already contains Java source (examples/java-spring-boot-service) and gains more with the nv-boot-parent import, so Java should be covered by the same security scan as Go and Rust. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe CodeQL workflow now triggers for Java file changes on pushes and pull requests, and analyzes Java/Kotlin sources using buildless extraction. ChangesJava CodeQL Coverage
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
🛡️ CodeQL Analysis🚨 Found 2 issue(s) Severity Breakdown:
📋 Top Issues🔗 View full details in Security tab 🕐 Last updated: 2026-07-20 21:07:28 UTC | Commit: f647e2e |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 13: Update the CodeQL workflow path filters to include both Kotlin
patterns, **/*.kt and **/*.kts, alongside **/*.java in each applicable filter.
Ensure both filter entries use the same Java-and-Kotlin coverage so Kotlin-only
changes trigger the workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6e536499-d812-4d0b-a027-c6f5b1316984
📒 Files selected for processing (1)
.github/workflows/codeql.yml
| - "src/**" | ||
| - "**/*.go" | ||
| - "**/*.rs" | ||
| - "**/*.java" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Trigger CodeQL for Kotlin source changes too.
Because the matrix claims Java/Kotlin coverage, add **/*.kt and **/*.kts to both path filters. Otherwise Kotlin-only changes will not run this workflow.
Also applies to: 25-25
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 13, Update the CodeQL workflow path
filters to include both Kotlin patterns, **/*.kt and **/*.kts, alongside
**/*.java in each applicable filter. Ensure both filter entries use the same
Java-and-Kotlin coverage so Kotlin-only changes trigger the workflow.
|
Folded into #269 (cherry-picked the |
1 participant
Why
The monorepo already contains Java source (
examples/java-spring-boot-service) and gains more with the incoming nv-boot-parent import, but CodeQL only scanned Go and Rust. Java should get the same security coverage.What changed
java-kotlinto the CodeQL matrix withbuild-mode: none. Java supports buildless (source-only) extraction, so it scans on PRs like Rust, with no Bazel/Maven build required.**/*.javachanges in addition to Go/Rust paths.Customer Release Notes
Not customer visible. CI security scanning.
Plan Summary
Not applicable.
Usage
Not applicable. Runs automatically on push/PR touching Java (and the weekly full scan).
Testing
.github/workflows/codeql.ymlparses as valid YAML. CodeQLjava-kotlin+build-mode: noneis the standard buildless Java configuration; findings surface in the Security tab and as PR comments, non-blocking during rollout (fail-on-findings: false), same as Go/Rust.Notes
Buildless keeps Java analysis cheap and avoids the autobuild complexity that makes Go expensive. If deeper analysis is later wanted, it can move to a built mode once the root Bazel Java integration lands.
References
NO-REF
Related Merge Requests/Pull Requests
None
Dependencies
None
Summary by CodeRabbit