java-maven-openjdk-codeql.yml

name: "CodeQL"

on:
  workflow_call:
    inputs:
      runs-on:
        description: |
          The type of machine to run the job on. Must be provided as a stringified list (e.g. `runs-on: '["ubuntu-latest","self-hosted"]'`)
        required: true
        type: string
      mvn-version:
        description: |
          The Maven version used for the execution. You can specify minor or patch version (3.9 or 3.9.1). Default : 3.9
        required: false
        type: number
        default: 3.9
      mvn-additional-arguments:
        description: |
          The additional arguments to pass to the Maven invocation. You can use this to specify a custom profile for example.
        required: false
        type: string
      jdk-version:
        description: |
          The JDK version to use for the build.
        required: true
        type: number

jobs:
  analyze-java:
    name: Analyze Java

    runs-on: ${{ fromJson(inputs.runs-on) }}

    container:
      image: maven:${{ inputs.mvn-version }}-eclipse-temurin-${{ inputs.jdk-version }}

    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      # Allow calling Git on a working copy owned by another user than the current one.
      # see: https://github.blog/2022-04-12-git-security-vulnerability-announced/
      - name: Git directory permission fix
        run: git config --global --add safe.directory $GITHUB_WORKSPACE

      # Fix HOME variable as GitHub is overriding it, and it breaks assumptions from maven.
      - run: echo "HOME=/root" >> $GITHUB_ENV

      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: java

      - name: Cache maven dependencies
        uses: actions/cache@v4
        with:
          path: ~/.m2
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-

      - name: Build project
        run: mvn ${{ inputs.mvn-additional-arguments }} -T1C --also-make --batch-mode --strict-checksums --update-snapshots -Dmaven.gitcommitid.skip=true -DskipTests clean test-compile

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:java"