codeQLworkflow.yml

name: "CodeQLworkflow"
on:
  workflow_call:
    inputs:
      maven-goals:
        description: maven goals to use, defaults to 'clean verify'
        required: false
        default: 'clean verify'
        type: string
      submodules:
        description: |
          Whether to checkout submodules: `true` to checkout submodules or `recursive` to recursively checkout submodules.
          When the `ssh-key` input is not provided, SSH URLs beginning with `git@github.com:` are converted to HTTPS.
          The value is just passed as it is to the github/actions/checkout action: https://github.com/actions/checkout#usage
        type: string
        required: false
        default: 'false'
      mavenVersion: 
        description: 'The version of Maven set up'
        type: string
        required: false
        default: '3.9.7'

jobs:
  analyze:
    name: Analyze
    # Runner size impacts CodeQL analysis time. To learn more, please see:
    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
    #   - https://gh.io/supported-runners-and-hardware-resources
    #   - https://gh.io/using-larger-runners
    # Consider using larger runners for possible analysis time improvements.
    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'java' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
        # Use only 'java' to analyze code written in Java, Kotlin or both
        # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

    steps:
    - name: Checkout repository
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      with:
       fetch-depth: 0 # required for jgit timestamp provider to work
       submodules: ${{ inputs.submodules }}

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}

    - name: Set up Java
      uses: actions/setup-java@6a0805fcefea3d4657a47ac4c165951e33482018 # v4.2.2
      with:
        java-version: |
          8
          11
          17
        mvn-toolchain-id: |
          JavaSE-1.8
          JavaSE-11
          JavaSE-17
        distribution: 'temurin'
        cache: maven
    - name: Set up Maven
      uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5
      with:
        maven-version: ${{ inputs.mavenVersion }}
    - name: Build with Maven
      uses: coactions/setup-xvfb@6b00cf1889f4e1d5a48635647013c0508128ee1a
      with:
       run: >- 
        mvn --batch-mode -V -U
        -ntp
        -Dcompare-version-with-baselines.skip=true
        -Pbree-libs
        -DskipTests=true
        --fail-at-end
        ${{ inputs.maven-goals }}

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{matrix.language}}"