(ofbiz-framework) branch trunk updated: Build Java explicitly with Gradle in the CodeQL workflow

[jacopoc]

This is an automated email from the ASF dual-hosted git repository.

jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 7adb2ac649 Build Java explicitly with Gradle in the CodeQL workflow
7adb2ac649 is described below

commit 7adb2ac6491ce412bf34909e7f52833f5e4d14bd
Author: Jacopo Cappellato <jacopo.cappell...@gmail.com>
AuthorDate: Thu Oct 1 17:15:41 2026 +0200

    Build Java explicitly with Gradle in the CodeQL workflow
    
    The Autobuild action doesn't know that gradle-wrapper.jar is not committed 
and must first be downloaded by init-gradle-wrapper.sh.
    It is replaced by a step that runs the script and then compiles the main 
and test Java sources with Gradle. Tests and Checkstyle no longer
    run during the analysis. The step runs only for the java matrix entry, 
since JavaScript needs no build. Leftover comments from GitHub's starter 
template are removed.
    
    Co-Authored-By: Claude Opus 5.5
---
 .github/workflows/codeql-analysis.yml | 37 ++++++++++-------------------------
 1 file changed, 10 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml 
b/.github/workflows/codeql-analysis.yml
index ea487a9c6d..69d1817f58 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -13,13 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
+# 
https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning
 
 name: "CodeQL"
 
@@ -48,11 +42,6 @@ jobs:
       fail-fast: false
       matrix:
         language: [ 'java', 'javascript' ]
-        #language: [  'javascript' ]
-        #language: [ 'javascript' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 
'python' ]
-        # Learn more:
-        # 
https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
 
     steps:
     - name: Checkout repository
@@ -69,21 +58,15 @@ jobs:
         # Prefix the list here with "+" to use these queries and those in the 
config file.
         # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually 
(see below)
-    - name: Autobuild
-      uses: 
github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # 
v4.38.2
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following 
three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
+    # Java is a compiled language: CodeQL extracts it by tracing the 
compilation,
+    # so the sources must be built between the init and analyze steps.
+    # The Gradle wrapper jar is not committed and must be downloaded first.
+    # Only compilation is needed, so tests and other checks are not run.
+    - name: Build with Gradle
+      if: matrix.language == 'java'
+      run: |
+        ./gradle/init-gradle-wrapper.sh
+        ./gradlew compileJava compileTestJava
 
     - name: Perform CodeQL Analysis
       uses: 
github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2