From f647e2eecc822a12c834989ed11ad5b5e13f6a1a Mon Sep 17 00:00:00 2001 From: Balaji Ganesan Date: Mon, 20 Jul 2026 14:04:27 -0700 Subject: [PATCH] ci(codeql): enable Java (java-kotlin) analysis Add java-kotlin to the CodeQL matrix with build-mode none. Java supports buildless extraction, so it scans on PRs like rust without a Bazel/Maven build. Trigger on *.java changes as well. The monorepo already contains Java source (examples/java-spring-boot-service) and gains more with the nv-boot-parent import, so Java should be covered by the same security scan as Go and Rust. Co-authored-by: Balaji Ganesan Co-Authored-By: Claude Opus 4.8 --- .github/workflows/codeql.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2f433b4ed..456135c85 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -10,6 +10,7 @@ on: - "src/**" - "**/*.go" - "**/*.rs" + - "**/*.java" - "**/go.mod" - "**/go.sum" - "**/Cargo.toml" @@ -21,6 +22,7 @@ on: - "src/**" - "**/*.go" - "**/*.rs" + - "**/*.java" - "**/go.mod" - "**/go.sum" - "**/Cargo.toml" @@ -54,6 +56,10 @@ jobs: build-mode: autobuild - language: rust build-mode: none + # Java (CodeQL id java-kotlin) supports buildless extraction, so it + # runs build-mode none like rust: no Bazel/Maven build on PRs. + - language: java-kotlin + build-mode: none steps: - name: Checkout repository uses: actions/checkout@v4