From a7e4a1c89aad3f1e7b2b6e624f0aafe86fee4a3a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torbj=C3=B8rn=20B=C3=B8e=20Lauvvik?= <tbl@origin.no>
Date: Thu, 12 Nov 2026 11:44:59 +0100
Subject: [PATCH] ci(codeql): optional build-mode input to scan without
 building

Legacy projects that can't be built on GitHub-hosted runners (no root
pom, unpublished or unreachable dependencies) fail in autobuild, so they
get no results at all. With `build-mode: none` CodeQL analyses Java from
the source only; other languages are scanned as before. Autobuild and the
custom build step are skipped in that mode.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4a2a967..19f31a5 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,6 +32,14 @@ on:
           compilers this command runs. Leave empty to use autobuild.
         type: string
         default: ''
+      build-mode:
+        description: >-
+          Set to `none` to scan without building, for legacy projects that
+          can't be built on GitHub's runners (no root pom, unpublished or
+          unreachable dependencies). Java is then analysed from the source
+          only, with somewhat lower precision. Leave empty to build.
+        type: string
+        default: ''
     secrets:
       PACKAGES_TOKEN:
         # Optional: only needed for projects that resolve packages from
@@ -100,6 +108,7 @@ jobs:
         uses: github/codeql-action/init@v4.39.1
         with:
           queries: security-extended
+          build-mode: ${{ inputs.build-mode }}
           # Autobuild runs before the JS extraction and copies webapp files to
           # target/, so without this every JS finding is reported twice.
           # Doesn't affect Java, which is analysed from the compilation.
@@ -108,11 +117,11 @@ jobs:
               - '**/target/**'
 
       - name: Autobuild
-        if: inputs.build-command == ''
+        if: inputs.build-command == '' && inputs.build-mode != 'none'
         uses: github/codeql-action/autobuild@v4.39.1
 
       - name: Build
-        if: inputs.build-command != ''
+        if: inputs.build-command != '' && inputs.build-mode != 'none'
         env:
           BUILD_COMMAND: ${{ inputs.build-command }}
         run: eval "$BUILD_COMMAND"