Force task re-execution in CodeQL compile step#17
Merged
Conversation
--no-build-cache (added in #15) stops Gradle from resolving compile tasks FROM-CACHE, but restored incremental state can still mark them UP-TO-DATE, in which case kotlinc never launches and CodeQL's manual-build extractor sees no compilation. Add --rerun-tasks so the scanned compile tasks always execute for real; dependency caching from setup-gradle stays in effect. Verified locally: the exact workflow command reports "27 actionable tasks: 27 executed" with zero UP-TO-DATE/FROM-CACHE outcomes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The CodeQL job uses
build-mode: manual, so its extractor only sees code that is actually compiled during the "Compile JVM Kotlin sources" step. #15 added--no-build-cache, which prevents FROM-CACHE outcomes, but Gradle can still mark the compile tasks UP-TO-DATE from restored incremental state — then kotlinc never launches, the extractor observes nothing, and the scan silently covers zero or partial Kotlin (oranalyzefails with "no source code seen").Fix: add
--rerun-tasksto the same invocation. This ignores up-to-date checks for the whole task graph of the listed tasks, guaranteeing real compilation on every run. Trade-off: the step reruns every upstream task too (KSP, plugin classes, codegen), costing a few extra minutes per scan — acceptable for a weekly/PR security job where completeness matters more than speed. Dependency caching fromsetup-gradleis unaffected.Verified locally by running the exact workflow command:
27 actionable tasks: 27 executed, zero UP-TO-DATE/FROM-CACHE outcomes, all listedcompileKotlinJvm/classestasks executed.Note: this touches the same line as any sibling PR extending the module list of this step, so it may trivially conflict — resolve by keeping both the flags and the extended list.
🤖 Generated with Claude Code