For CodeQL runs on Maven Java projects, the default-generated workflow, which runs autobuild, fails with error: invalid target release: 17 if the project requires JDK 17 (or, apparently, any version besides JDK 8). The same failure occurs if autobuild is replaced with a basic mvn compile manual build step.
Several issues have comments describing a solution (namely, adding a setup-java action) -- but I could not find any mention of it in the CodeQL config docs (1, 2, 3, 4). In fact, these docs strongly suggest that setting up the right version of Java build tools is only required if using self-hosted runners:
- From CodeQL code scanning for compiled languages:
Note: If you use self-hosted runners for GitHub Actions, you may need to install additional software to use the autobuild process. Additionally, if your repository requires a specific version of a build tool, you may need to install it manually. GitHub-hosted runners are always run with the software required by autobuild.
- Further down:
If you're using self-hosted runners, the required version(s) of Java should be present:
If the runner will be used for analyzing repositories that need a single version of Java, then the appropriate JDK version needs to be installed, and needs to be present in the PATH variable (so that java and javac can be found).
If the runner will be used for analyzing repositories that need multiple versions of Java, then the appropriate JDK versions need to be installed, and can be specified via the toolchains.xml file. This is a configuration file, typically used by Apache Maven, that allows you to specify the location of the tools, the version of the tools, and any additional configuration that is required to use the tools. For more information, see "Guide to Using Toolchains" in the Apache Maven documentation.
Many people have tripped over this: 1, 2, 3, 4, 5.
There was already an intention to autodetect the needed JDK version, which would be the ideal solution. (It could be implemented by looking for any <maven.compiler.target/> element in pom.xml.) But if that's tricky, then please at least document that manually adding setup-java to the workflow is needed for JDK versions other than 8.
For CodeQL runs on Maven Java projects, the default-generated workflow, which runs autobuild, fails with
error: invalid target release: 17if the project requires JDK 17 (or, apparently, any version besides JDK 8). The same failure occurs if autobuild is replaced with a basicmvn compilemanual build step.Several issues have comments describing a solution (namely, adding a
setup-javaaction) -- but I could not find any mention of it in the CodeQL config docs (1, 2, 3, 4). In fact, these docs strongly suggest that setting up the right version of Java build tools is only required if using self-hosted runners:Many people have tripped over this: 1, 2, 3, 4, 5.
There was already an intention to autodetect the needed JDK version, which would be the ideal solution. (It could be implemented by looking for any
<maven.compiler.target/>element inpom.xml.) But if that's tricky, then please at least document that manually addingsetup-javato the workflow is needed for JDK versions other than 8.