From e07407d889735f4b9e22039aee17273b16effe2d Mon Sep 17 00:00:00 2001 From: Ruslan Ibrahimau Date: Sun, 19 Jul 2026 11:49:00 +0300 Subject: [PATCH] Scan all JVM Kotlin modules in CodeQL The manual-build compile step only covered 8 of the 12 JVM-compiling modules, so CodeQL never extracted :samples-cli (CLI entrypoint), :test-support-wat (WAT lexer/binary writer parsing untrusted text), :annotations, or :benchmarks. Add their compile tasks so the security-extended queries see that code. :footprint-baseline and :footprint-core declare only an iosArm64 target and have no JVM compilation, so they stay out. Co-Authored-By: Claude Fable 5 --- .github/workflows/codeql.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 351c347..ddc3f13 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -57,6 +57,10 @@ jobs: :bindgen-ksp:classes :gradle-plugin:classes :tck:compileKotlinJvm + :annotations:compileKotlinJvm + :samples-cli:compileKotlin + :test-support-wat:compileKotlinJvm + :benchmarks:compileKotlinJvm - name: Perform CodeQL analysis uses: github/codeql-action/analyze@v4