Question

A team maintains a large Java service and wants to add CodeQL analysis via GitHub Actions advanced setup. Their build system uses a proprietary Gradle plugin that frequently fails in the default autobuild step, causing the CodeQL database creation to error out before analysis. They want CodeQL to analyze the Java code without executing their build. Which configuration change should they make in the CodeQL workflow?

Accepted Answer

Set the `build-mode` to `none` for the Java language in the `github/codeql-action/init` step so CodeQL builds the database without invoking the project build

Answer

Remove the `autobuild` step and rely on CodeQL's automatic language detection to skip compilation for all languages

Answer

Switch the query suite to `security-extended`, which disables build requirements for compiled languages

Answer

Add `paths-ignore` for the Gradle build files so CodeQL does not attempt to compile them