From fe1a54c23f818be022eb25715a53abe389521400 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Mon, 31 Aug 2026 01:27:36 -0700
Subject: [PATCH 1/5] fix:codeql scan

---
 .github/scripts/codeql-matrix.sh  |  4 +++-
 .github/workflows/codeql-full.yml | 16 +++++++++++++++-
 .github/workflows/codeql.yml      |  2 +-
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/.github/scripts/codeql-matrix.sh b/.github/scripts/codeql-matrix.sh
index 8ed26028..cfbe3b8a 100644
--- a/.github/scripts/codeql-matrix.sh
+++ b/.github/scripts/codeql-matrix.sh
@@ -2,6 +2,8 @@
 
 set -euo pipefail
 
+java_build_mode="${1:-autobuild}"
+
 matrix_entries=""
 
 has_files() {
@@ -22,7 +24,7 @@ if has_files '.github/workflows/*.yml' '.github/workflows/*.yaml'; then
 fi
 
 if has_files '*.java'; then
-    add_entry '{"language":"java-kotlin","build-mode":"autobuild"}'
+    add_entry "{\"language\":\"java-kotlin\",\"build-mode\":\"$java_build_mode\"}"
 fi
 
 if has_files '*.js' '*.jsx' '*.ts' '*.tsx' '*.mjs' '*.cjs' '*.vue' '*.html'; then
diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index fc1e5c34..cee04a6d 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -27,7 +27,7 @@ jobs:
         id: matrix
         shell: bash
         run: |
-          matrix=$(bash .github/scripts/codeql-matrix.sh)
+          matrix=$(bash .github/scripts/codeql-matrix.sh manual)
           printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
 
   analyze:
@@ -66,4 +66,18 @@ jobs:
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4
         with:
+          output: ${{ runner.temp }}/codeql-results
+          post-processed-sarif-path: ${{ runner.temp }}/codeql-results-processed
+          upload: always
           category: "/codeql-full:${{ matrix.language }}"
+
+      - name: Upload CodeQL SARIF report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: codeql-full-sarif-${{ matrix.language }}
+          path: |
+            ${{ runner.temp }}/codeql-results
+            ${{ runner.temp }}/codeql-results-processed
+          if-no-files-found: warn
+          retention-days: 30
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 50486ab2..d022f03d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,7 +28,7 @@ jobs:
         id: matrix
         shell: bash
         run: |
-          matrix=$(bash .github/scripts/codeql-matrix.sh)
+          matrix=$(bash .github/scripts/codeql-matrix.sh autobuild)
           printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
 
   analyze:

From 82fdc15b91916a8f900bf7faa3da9a8ee3ef2569 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Mon, 31 Aug 2026 02:26:55 -0700
Subject: [PATCH 2/5] fix:codeql scan

---
 .github/workflows/codeql-full.yml | 47 +++++++++++++++++++++++++++----
 1 file changed, 42 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index cee04a6d..eda9267c 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -64,6 +64,7 @@ jobs:
         run: mvn -B clean test-compile -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true -Dspotbugs.skip=true -Dcpd.skip=true
 
       - name: Perform CodeQL Analysis
+        id: codeql-analysis
         uses: github/codeql-action/analyze@v4
         with:
           output: ${{ runner.temp }}/codeql-results
@@ -71,13 +72,49 @@ jobs:
           upload: always
           category: "/codeql-full:${{ matrix.language }}"
 
+      - name: Collect CodeQL SARIF reports
+        if: always()
+        shell: bash
+        env:
+          CODEQL_OUTPUT: ${{ runner.temp }}/codeql-results
+          CODEQL_PROCESSED_OUTPUT: ${{ runner.temp }}/codeql-results-processed
+          CODEQL_SARIF_OUTPUT: ${{ steps.codeql-analysis.outputs.sarif-output }}
+        run: |
+          rm -rf codeql-sarif
+          mkdir -p codeql-sarif
+
+          {
+            printf 'language=%s\n' '${{ matrix.language }}'
+            printf 'codeql_output=%s\n' "$CODEQL_OUTPUT"
+            printf 'post_processed_output=%s\n' "$CODEQL_PROCESSED_OUTPUT"
+            printf 'action_sarif_output=%s\n' "$CODEQL_SARIF_OUTPUT"
+            printf '\nGenerated SARIF files:\n'
+          } > codeql-sarif/scan-files.txt
+
+          for directory in "$CODEQL_OUTPUT" "$CODEQL_PROCESSED_OUTPUT" "$CODEQL_SARIF_OUTPUT"; do
+            if [[ -n "$directory" && -d "$directory" ]]; then
+              find "$directory" -type f -name '*.sarif' -print0 |
+                while IFS= read -r -d '' file; do
+                  cp "$file" "codeql-sarif/$(basename "$file")"
+                  printf '%s\n' "$file" >> codeql-sarif/scan-files.txt
+                done
+            fi
+          done
+
+          find "$RUNNER_TEMP" -type f -name '*.sarif' -print0 |
+            while IFS= read -r -d '' file; do
+              target="codeql-sarif/$(basename "$file")"
+              if [[ ! -e "$target" ]]; then
+                cp "$file" "$target"
+                printf '%s\n' "$file" >> codeql-sarif/scan-files.txt
+              fi
+            done
+
       - name: Upload CodeQL SARIF report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: codeql-full-sarif-${{ matrix.language }}
-          path: |
-            ${{ runner.temp }}/codeql-results
-            ${{ runner.temp }}/codeql-results-processed
-          if-no-files-found: warn
+          path: codeql-sarif
+          if-no-files-found: error
           retention-days: 30

From a09a635796cef40888e6b4b32110b8e025ae5c47 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Mon, 31 Aug 2026 19:08:28 -0700
Subject: [PATCH 3/5] fix:codeql scan

---
 .github/workflows/codeql-full.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index eda9267c..9b2f9210 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -15,11 +15,13 @@ jobs:
   detect:
     name: Detect CodeQL languages
     runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true   
     outputs:
       matrix: ${{ steps.matrix.outputs.matrix }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

From b1087fcffe041508aa745893a7c189d9cbcdc8b6 Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Mon, 31 Aug 2026 19:21:42 -0700
Subject: [PATCH 4/5] fix:codeql scan

---
 .github/workflows/codeql-full.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index 9b2f9210..f5d77d4a 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

From c919e360c1da827578459949d864e0752a50deec Mon Sep 17 00:00:00 2001
From: msslulu <1484036491@qq.com>
Date: Mon, 31 Aug 2026 20:29:45 -0700
Subject: [PATCH 5/5] fix:codeql scan

---
 .github/workflows/codeql-full.yml | 97 ++++++++++++++++++++++---------
 1 file changed, 68 insertions(+), 29 deletions(-)

diff --git a/.github/workflows/codeql-full.yml b/.github/workflows/codeql-full.yml
index f5d77d4a..db8b6a77 100644
--- a/.github/workflows/codeql-full.yml
+++ b/.github/workflows/codeql-full.yml
@@ -65,52 +65,62 @@ jobs:
         if: matrix.language == 'java-kotlin'
         run: mvn -B clean test-compile -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true -Dspotbugs.skip=true -Dcpd.skip=true
 
+      - name: Prepare CodeQL SARIF directory
+        shell: bash
+        run: |
+          rm -rf codeql-sarif
+          mkdir -p codeql-sarif
+
       - name: Perform CodeQL Analysis
         id: codeql-analysis
         uses: github/codeql-action/analyze@v4
         with:
-          output: ${{ runner.temp }}/codeql-results
-          post-processed-sarif-path: ${{ runner.temp }}/codeql-results-processed
+          output: ${{ github.workspace }}/codeql-sarif
           upload: always
           category: "/codeql-full:${{ matrix.language }}"
 
-      - name: Collect CodeQL SARIF reports
+      - name: Summarize CodeQL SARIF report
+        id: sarif-summary
         if: always()
         shell: bash
-        env:
-          CODEQL_OUTPUT: ${{ runner.temp }}/codeql-results
-          CODEQL_PROCESSED_OUTPUT: ${{ runner.temp }}/codeql-results-processed
-          CODEQL_SARIF_OUTPUT: ${{ steps.codeql-analysis.outputs.sarif-output }}
         run: |
-          rm -rf codeql-sarif
+          set -euo pipefail
+
           mkdir -p codeql-sarif
+          report_index="codeql-sarif/scan-files.txt"
+          sarif_count=0
+          invalid_sarif=0
+          violations=0
 
           {
             printf 'language=%s\n' '${{ matrix.language }}'
-            printf 'codeql_output=%s\n' "$CODEQL_OUTPUT"
-            printf 'post_processed_output=%s\n' "$CODEQL_PROCESSED_OUTPUT"
-            printf 'action_sarif_output=%s\n' "$CODEQL_SARIF_OUTPUT"
+            printf 'codeql_output=%s\n' '${{ github.workspace }}/codeql-sarif'
             printf '\nGenerated SARIF files:\n'
-          } > codeql-sarif/scan-files.txt
-
-          for directory in "$CODEQL_OUTPUT" "$CODEQL_PROCESSED_OUTPUT" "$CODEQL_SARIF_OUTPUT"; do
-            if [[ -n "$directory" && -d "$directory" ]]; then
-              find "$directory" -type f -name '*.sarif' -print0 |
-                while IFS= read -r -d '' file; do
-                  cp "$file" "codeql-sarif/$(basename "$file")"
-                  printf '%s\n' "$file" >> codeql-sarif/scan-files.txt
-                done
+          } > "$report_index"
+
+          while IFS= read -r -d '' file; do
+            sarif_count=$((sarif_count + 1))
+            result_count=$(jq '[.runs[]?.results[]?] | length' "$file" 2>/dev/null || true)
+
+            if [[ "$result_count" =~ ^[0-9]+$ ]]; then
+              violations=$((violations + result_count))
+              printf '%s results=%s\n' "$file" "$result_count" >> "$report_index"
+            else
+              invalid_sarif=$((invalid_sarif + 1))
+              printf '%s results=invalid-sarif\n' "$file" >> "$report_index"
             fi
-          done
+          done < <(find codeql-sarif -type f -name '*.sarif' -print0)
 
-          find "$RUNNER_TEMP" -type f -name '*.sarif' -print0 |
-            while IFS= read -r -d '' file; do
-              target="codeql-sarif/$(basename "$file")"
-              if [[ ! -e "$target" ]]; then
-                cp "$file" "$target"
-                printf '%s\n' "$file" >> codeql-sarif/scan-files.txt
-              fi
-            done
+          {
+            printf '\nSummary:\n'
+            printf 'sarif_count=%s\n' "$sarif_count"
+            printf 'invalid_sarif=%s\n' "$invalid_sarif"
+            printf 'violations=%s\n' "$violations"
+          } >> "$report_index"
+
+          printf 'sarif_count=%s\n' "$sarif_count" >> "$GITHUB_OUTPUT"
+          printf 'invalid_sarif=%s\n' "$invalid_sarif" >> "$GITHUB_OUTPUT"
+          printf 'violations=%s\n' "$violations" >> "$GITHUB_OUTPUT"
 
       - name: Upload CodeQL SARIF report
         if: always()
@@ -120,3 +130,32 @@ jobs:
           path: codeql-sarif
           if-no-files-found: error
           retention-days: 30
+
+      - name: Check CodeQL findings
+        if: always()
+        shell: bash
+        env:
+          SARIF_COUNT: ${{ steps.sarif-summary.outputs.sarif_count }}
+          INVALID_SARIF: ${{ steps.sarif-summary.outputs.invalid_sarif }}
+          VIOLATIONS: ${{ steps.sarif-summary.outputs.violations }}
+        run: |
+          sarif_count="${SARIF_COUNT:-0}"
+          invalid_sarif="${INVALID_SARIF:-0}"
+          violations="${VIOLATIONS:-0}"
+
+          if [[ "$sarif_count" -eq 0 ]]; then
+            echo "::error::CodeQL did not produce a SARIF report."
+            exit 1
+          fi
+
+          if [[ "$invalid_sarif" -ne 0 ]]; then
+            echo "::error::CodeQL produced $invalid_sarif invalid SARIF report(s)."
+            exit 1
+          fi
+
+          if [[ "$violations" -ne 0 ]]; then
+            echo "::error::CodeQL found $violations result(s)."
+            exit 1
+          fi
+
+          echo "CodeQL found no results."