Skip to content

Remove Java/Kotlin from CodeQL setup#6

Open
mendral-app[bot] wants to merge 1 commit into
masterfrom
mendral/remove-java-kotlin-codeql
Open

Remove Java/Kotlin from CodeQL setup#6
mendral-app[bot] wants to merge 1 commit into
masterfrom
mendral/remove-java-kotlin-codeql

Conversation

@mendral-app
Copy link
Copy Markdown

@mendral-app mendral-app Bot commented Jun 3, 2026

Summary

  • Add a custom CodeQL workflow that scans only languages present in the repo (c-cpp, csharp, go, javascript-typescript, python, ruby, rust, swift), excluding java-kotlin which has caused 25+ consecutive weekly failures since December 2025.

Important

Manual Steps Required Before Merging

  • Disable the default CodeQL setup in repository settings: Settings → Code security and analysis → CodeQL analysis → Disable "Default setup"

This is required because the default setup runs independently of workflow files. Once disabled, this custom workflow will handle all CodeQL scanning without the failing java-kotlin job.

Context

The CodeQL default setup includes Java/Kotlin language scanning but the repository has no Java/Kotlin source code. Every weekly scheduled run fails with exit code 32: "CodeQL detected code written in C/C++, Ruby, GitHub Actions, JavaScript/TypeScript, Python, Go, Rust, Swift and C#, but not any written in Java/Kotlin."

Related insight: https://app.mendral.com/insights/01KT5J5Q1WV16BS5Q3P1JXWCT8


Note

Created by Mendral. Tag @mendral-app with feedback or questions.

The default CodeQL setup includes java-kotlin language scanning but the
repository has no Java/Kotlin code, causing 25+ consecutive weekly
failures since December 2025.

This custom workflow replaces the default setup and only scans languages
actually present in the repo: c-cpp, csharp, go, javascript-typescript,
python, ruby, rust, and swift.

Note: The default CodeQL setup must still be disabled in repository
settings (Settings > Code security > CodeQL) for this custom workflow
to take effect.
@mendral-app mendral-app Bot requested a review from a team June 3, 2026 01:41
@mendral-app
Copy link
Copy Markdown
Author

mendral-app Bot commented Jun 3, 2026

CI Failure Explanation

The CodeQL / Analyze (*) job failures are expected while the default CodeQL setup is still enabled. GitHub explicitly blocks custom workflow SARIF uploads when the default setup is active:

CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled

To resolve: Before merging, disable the default CodeQL setup in repository settings (Settings → Code security → CodeQL → Disable default setup). Once disabled, this custom workflow will handle all code scanning without java-kotlin.

The default setup jobs (PR #6 / Analyze) confirm the fix works — all languages pass except java-kotlin (the one we're removing).

@mendral-app mendral-app Bot marked this pull request as ready for review June 3, 2026 02:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants