ci: cool down Kotlin bumps to match CodeQL extractor lag - #10
Merged
Conversation
CodeQL's Kotlin extractor runs inside the Kotlin compiler and hard-errors on
versions it does not yet support ("Kotlin version 2.4.10 is too recent"), so
the CodeQL workflow cannot compile a too-new Kotlin at all. Support has
consistently trailed Kotlin releases by ~21-35 days (2.3.20: 30d, 2.4.0: 35d,
2.4.10: merged upstream in github/codeql#22194, ships in CodeQL 2.26.2).
Dependabot proposing Kotlin the week it ships therefore just parks a red PR
until the next CodeQL CLI release lands, as with #4. A 30-day cooldown scoped
to org.jetbrains.kotlin* lines the PR up with when it can actually merge; the
rest of the Gradle dependencies keep the 3-day default.
Kotlin's .10/.20 releases are semver-patch bumps relative to each other, so
semver-patch-days carries most of the weight; semver-minor-days matches it so
a 2.5.0 does not slip through the gap.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
PR #4 (
org.jetbrains.kotlin.jvm2.4.0 → 2.4.10) has a redAnalyze (java-kotlin)check:This is not fixable in this repo. The check lives in CodeQL's Kotlin extractor, which runs
inside the Kotlin compiler, so no Gradle flag avoids it. The fix is already merged upstream —
github/codeql#22194 (2026-07-15) raises the ceiling
to
< 2.4.20— but it missed the CodeQL 2.26.1 cut by a day (verified: the merge commit is not anancestor of
codeql-cli/v2.26.1), so it ships in 2.26.2, expected early August.What this changes
CodeQL's Kotlin support has consistently trailed Kotlin releases:
So Dependabot proposing Kotlin the week it ships just parks a red PR for a month. A 30-day
cooldownscoped toorg.jetbrains.kotlin*lines the PR up with when it can actually merge.Everything else in the
gradleecosystem keeps the 3-day default.Kotlin's
.10/.20releases are semver-patch bumps relative to each other, sosemver-patch-daysdoes most of the work;semver-minor-daysmatches it so a2.5.0doesn't slipthrough. Gradle supports both sub-options.
This is preventative — it does not unblock #4, which stays open until CodeQL 2.26.2. It matters
because Kotlin 2.4.20-Beta2 is
already out and, per github/codeql#22189, "2.4.20
contains compiler plugin changes" — so it will need real extractor work and will block again.
Rejected alternatives
build-mode: none— turns the job green instantly, but the docs are explicit: "ifbuild-modeis set tononeand Kotlin code is found in the repository, the Kotlin code will notbe analyzed and a warning will be produced." This codebase is 100% Kotlin, so CodeQL would scan
nothing. A silent security regression, not a fix.
github/codeql; the onlyCODEQL_EXTRACTOR_KOTLIN_*references are logging/telemetry).tools:on theinitstep to grab 2.26.2 ahead of acodeql-actionrelease — theaction bumps its default bundle within hours of a bundle publish (2.26.1: bundle 09:06 UTC, action
15:35 UTC), so this buys nothing and costs reproducibility.
🤖 Generated with Claude Code