From 00313ac30f544e7f458ab6ba8f33c082f6cfd51b Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 14:29:28 +0800
Subject: [PATCH 01/23] Add CodeQL analysis workflow configuration

---
 .github/workflows/codeql.yml | 101 +++++++++++++++++++++++++++++++++++
 1 file changed, 101 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..e188015
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,101 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    - cron: '27 15 * * 4'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: java-kotlin
+          build-mode: none # This mode only analyzes Java. Set this to 'autobuild' or 'manual' to analyze Kotlin too.
+        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
+        # Use `c-cpp` to analyze code written in C, C++ or both
+        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
+        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Add any setup steps before running the `github/codeql-action/init` action.
+    # This includes steps like installing compilers or runtimes (`actions/setup-node`
+    # or others). This is typically only required for manual builds.
+    # - name: Setup runtime (example)
+    #   uses: actions/setup-example@v1
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+    # If the analyze step fails for one of the languages you are analyzing with
+    # "We were unable to automatically build your code", modify the matrix above
+    # to set the build mode to "manual" for that language. Then modify this step
+    # to build your code.
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+    - name: Run manual build steps
+      if: matrix.build-mode == 'manual'
+      shell: bash
+      run: |
+        echo 'If you are using a "manual" build mode for one or more of the' \
+          'languages you are analyzing, replace this with the commands to build' \
+          'your code, for example:'
+        echo '  make bootstrap'
+        echo '  make release'
+        exit 1
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{matrix.language}}"

From f5fd261361cf076bbacc3db83339a5c5b0ea798c Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 14:34:12 +0800
Subject: [PATCH 02/23] Add CodeQL analysis workflow for Java 8

---
 .github/workflows/codeql1.yml | 83 +++++++++++++++++++++++++++++++++++
 1 file changed, 83 insertions(+)
 create mode 100644 .github/workflows/codeql1.yml

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
new file mode 100644
index 0000000..f6238bf
--- /dev/null
+++ b/.github/workflows/codeql1.yml
@@ -0,0 +1,83 @@
+name: "CodeQL (Java 8 - Default Rules)"
+
+on:
+  push:
+    branches: [ "master" ]
+    tags:
+      - "**"   # 未来 push 任意 tag 都自动扫描
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    - cron: "27 12 * * 3"
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "要扫描的分支或Tag（例如：master / v1.2.3）"
+        required: true
+        default: "master"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze-java:
+    name: Analyze (Java)
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
+          fetch-depth: 0
+
+      - name: Set up Java 8
+        uses: actions/setup-java@v4
+        with:
+          distribution: "temurin"
+          java-version: "8"
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: java-kotlin
+          build-mode: manual
+          # 不写 queries: => 默认规则库（default query suite）
+
+      - name: Build project (manual)
+        shell: bash
+        run: |
+          set -euxo pipefail
+
+          if [ -f "./gradlew" ] || [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
+            echo "Detected Gradle project"
+            if [ -f "./gradlew" ]; then
+              chmod +x ./gradlew
+              ./gradlew --no-daemon clean build -x test
+            else
+              gradle --no-daemon clean build -x test
+            fi
+
+          elif [ -f "./mvnw" ] || [ -f "pom.xml" ]; then
+            echo "Detected Maven project"
+            if [ -f "./mvnw" ]; then
+              chmod +x ./mvnw
+              ./mvnw -B -DskipTests package
+            else
+              mvn -B -DskipTests package
+            fi
+
+          else
+            echo "ERROR: No supported build tool found (Gradle/Maven)."
+            exit 1
+          fi
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:java-kotlin"
+

From 88b1f94673a5b237d4b08105cf88ede6f6d0aa52 Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 15:01:17 +0800
Subject: [PATCH 03/23] Update CodeQL workflow for Java build detection

---
 .github/workflows/codeql1.yml | 138 ++++++++++++++++++++++++++++------
 1 file changed, 115 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index f6238bf..63a4934 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -1,18 +1,16 @@
-name: "CodeQL (Java 8 - Default Rules)"
+name: "CodeQL (Java - Default Rules, build auto-fallback)"
 
 on:
   push:
-    branches: [ "master" ]
+    branches: [ "main", "master" ]
     tags:
-      - "**"   # 未来 push 任意 tag 都自动扫描
+      - "**"
   pull_request:
-    branches: [ "master" ]
-  schedule:
-    - cron: "27 12 * * 3"
+    branches: [ "main", "master" ]
   workflow_dispatch:
     inputs:
       ref:
-        description: "要扫描的分支或Tag（例如：master / v1.2.3）"
+        description: "要扫描的分支或 Tag（例如：master / v1.2.3）"
         required: true
         default: "master"
 
@@ -35,49 +33,143 @@ jobs:
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
           fetch-depth: 0
 
-      - name: Set up Java 8
-        uses: actions/setup-java@v4
+      - name: Detect build system
+        id: detect
+        shell: bash
+        run: |
+          set -e
+          if [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
+            echo "build=gradle" >> "$GITHUB_OUTPUT"
+          elif [ -f "pom.xml" ]; then
+            echo "build=maven" >> "$GITHUB_OUTPUT"
+          else
+            echo "build=none" >> "$GITHUB_OUTPUT"
+          fi
+
+          if [ -f "./gradlew" ]; then
+            echo "has_gradlew=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_gradlew=false" >> "$GITHUB_OUTPUT"
+          fi
+
+          if [ -f "./mvnw" ]; then
+            echo "has_mvnw=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_mvnw=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      # 如果是 Gradle 项目但没有 wrapper，就装一个“兼容性更好”的 Gradle 7.6.4
+      # 这样就不会用到系统 Gradle 9.x（它强制要求 Java17+）
+      - name: Setup Gradle (only when no wrapper)
+        if: ${{ steps.detect.outputs.build == 'gradle' && steps.detect.outputs.has_gradlew == 'false' }}
+        uses: gradle/actions/setup-gradle@v4
         with:
-          distribution: "temurin"
-          java-version: "8"
+          gradle-version: "7.6.4"
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:
           languages: java-kotlin
           build-mode: manual
-          # 不写 queries: => 默认规则库（default query suite）
+          # 不写 queries: => 使用 CodeQL 默认规则库（default query suite）
+
+      # --------- Build Try 1: Java 17 ----------
+      - name: Set up Java 17
+        id: j17
+        uses: actions/setup-java@v4
+        with:
+          distribution: "temurin"
+          java-version: "17"
 
-      - name: Build project (manual)
+      - name: Build with Java 17
+        id: build17
+        continue-on-error: true
         shell: bash
         run: |
           set -euxo pipefail
-
-          if [ -f "./gradlew" ] || [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
-            echo "Detected Gradle project"
+          if [ "${{ steps.detect.outputs.build }}" = "gradle" ]; then
             if [ -f "./gradlew" ]; then
               chmod +x ./gradlew
-              ./gradlew --no-daemon clean build -x test
+              ./gradlew --no-daemon clean assemble -x test
+            else
+              gradle --no-daemon clean assemble -x test
+            fi
+          elif [ "${{ steps.detect.outputs.build }}" = "maven" ]; then
+            if [ -f "./mvnw" ]; then
+              chmod +x ./mvnw
+              ./mvnw -B -DskipTests package
             else
-              gradle --no-daemon clean build -x test
+              mvn -B -DskipTests package
             fi
+          else
+            echo "ERROR: No build files (Gradle/Maven) found."
+            exit 1
+          fi
 
-          elif [ -f "./mvnw" ] || [ -f "pom.xml" ]; then
-            echo "Detected Maven project"
+      # --------- Build Try 2: Java 11 ----------
+      - name: Set up Java 11
+        if: ${{ steps.build17.outcome != 'success' }}
+        id: j11
+        uses: actions/setup-java@v4
+        with:
+          distribution: "temurin"
+          java-version: "11"
+
+      - name: Build with Java 11
+        if: ${{ steps.build17.outcome != 'success' }}
+        id: build11
+        continue-on-error: true
+        shell: bash
+        run: |
+          set -euxo pipefail
+          if [ "${{ steps.detect.outputs.build }}" = "gradle" ]; then
+            if [ -f "./gradlew" ]; then
+              chmod +x ./gradlew
+              ./gradlew --no-daemon clean assemble -x test
+            else
+              gradle --no-daemon clean assemble -x test
+            fi
+          else
             if [ -f "./mvnw" ]; then
               chmod +x ./mvnw
               ./mvnw -B -DskipTests package
             else
               mvn -B -DskipTests package
             fi
+          fi
+
+      # --------- Build Try 3: Java 8 ----------
+      - name: Set up Java 8
+        if: ${{ steps.build17.outcome != 'success' && steps.build11.outcome != 'success' }}
+        id: j8
+        uses: actions/setup-java@v4
+        with:
+          distribution: "temurin"
+          java-version: "8"
 
+      - name: Build with Java 8
+        if: ${{ steps.build17.outcome != 'success' && steps.build11.outcome != 'success' }}
+        id: build8
+        shell: bash
+        run: |
+          set -euxo pipefail
+          if [ "${{ steps.detect.outputs.build }}" = "gradle" ]; then
+            if [ -f "./gradlew" ]; then
+              chmod +x ./gradlew
+              ./gradlew --no-daemon clean assemble -x test
+            else
+              gradle --no-daemon clean assemble -x test
+            fi
           else
-            echo "ERROR: No supported build tool found (Gradle/Maven)."
-            exit 1
+            if [ -f "./mvnw" ]; then
+              chmod +x ./mvnw
+              ./mvnw -B -DskipTests package
+            else
+              mvn -B -DskipTests package
+            fi
           fi
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4
         with:
           category: "/language:java-kotlin"
-

From 867d71bba115e5bb2c070203a2bc7e14c4fc5ec2 Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 15:15:02 +0800
Subject: [PATCH 04/23] Update codeql1.yml

---
 .github/workflows/codeql1.yml | 38 ++++-------------------------------
 1 file changed, 4 insertions(+), 34 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 63a4934..a3c601f 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -58,8 +58,7 @@ jobs:
             echo "has_mvnw=false" >> "$GITHUB_OUTPUT"
           fi
 
-      # 如果是 Gradle 项目但没有 wrapper，就装一个“兼容性更好”的 Gradle 7.6.4
-      # 这样就不会用到系统 Gradle 9.x（它强制要求 Java17+）
+      # 如果是 Gradle 项目但没有 wrapper，就装一个可控的 Gradle（避免系统 Gradle 9.x）
       - name: Setup Gradle (only when no wrapper)
         if: ${{ steps.detect.outputs.build == 'gradle' && steps.detect.outputs.has_gradlew == 'false' }}
         uses: gradle/actions/setup-gradle@v4
@@ -118,7 +117,6 @@ jobs:
       - name: Build with Java 11
         if: ${{ steps.build17.outcome != 'success' }}
         id: build11
-        continue-on-error: true
         shell: bash
         run: |
           set -euxo pipefail
@@ -129,44 +127,16 @@ jobs:
             else
               gradle --no-daemon clean assemble -x test
             fi
-          else
+          elif [ "${{ steps.detect.outputs.build }}" = "maven" ]; then
             if [ -f "./mvnw" ]; then
               chmod +x ./mvnw
               ./mvnw -B -DskipTests package
             else
               mvn -B -DskipTests package
             fi
-          fi
-
-      # --------- Build Try 3: Java 8 ----------
-      - name: Set up Java 8
-        if: ${{ steps.build17.outcome != 'success' && steps.build11.outcome != 'success' }}
-        id: j8
-        uses: actions/setup-java@v4
-        with:
-          distribution: "temurin"
-          java-version: "8"
-
-      - name: Build with Java 8
-        if: ${{ steps.build17.outcome != 'success' && steps.build11.outcome != 'success' }}
-        id: build8
-        shell: bash
-        run: |
-          set -euxo pipefail
-          if [ "${{ steps.detect.outputs.build }}" = "gradle" ]; then
-            if [ -f "./gradlew" ]; then
-              chmod +x ./gradlew
-              ./gradlew --no-daemon clean assemble -x test
-            else
-              gradle --no-daemon clean assemble -x test
-            fi
           else
-            if [ -f "./mvnw" ]; then
-              chmod +x ./mvnw
-              ./mvnw -B -DskipTests package
-            else
-              mvn -B -DskipTests package
-            fi
+            echo "ERROR: No build files (Gradle/Maven) found."
+            exit 1
           fi
 
       - name: Perform CodeQL Analysis

From 6574f3e2152951903b5c0d0dfa8b982bb1dfc9bd Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 15:25:28 +0800
Subject: [PATCH 05/23] Modify CodeQL workflow for build fallback

Updated CodeQL workflow to include a fallback for no-build analysis and adjusted build mode settings.
---
 .github/workflows/codeql1.yml | 107 +++++++++++++++++++---------------
 1 file changed, 61 insertions(+), 46 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index a3c601f..2eda949 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -1,4 +1,4 @@
-name: "CodeQL (Java - Default Rules, build auto-fallback)"
+name: "CodeQL (Java - Default Rules, build fallback to no-build)"
 
 on:
   push:
@@ -18,14 +18,20 @@ permissions:
   contents: read
 
 jobs:
-  analyze-java:
-    name: Analyze (Java)
+  # =========================
+  # 1) 尝试“构建模式”扫描（更准确）
+  # =========================
+  analyze-build:
+    name: Analyze (Java - build if possible)
     runs-on: ubuntu-latest
 
     permissions:
       contents: read
       security-events: write
 
+    outputs:
+      build_ok: ${{ steps.build_out.outputs.build_ok }}
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -58,34 +64,33 @@ jobs:
             echo "has_mvnw=false" >> "$GITHUB_OUTPUT"
           fi
 
-      # 如果是 Gradle 项目但没有 wrapper，就装一个可控的 Gradle（避免系统 Gradle 9.x）
+      # 没 wrapper 时装一个可控 Gradle（避免系统 Gradle 9.x 带来的 JDK 要求问题）
       - name: Setup Gradle (only when no wrapper)
         if: ${{ steps.detect.outputs.build == 'gradle' && steps.detect.outputs.has_gradlew == 'false' }}
         uses: gradle/actions/setup-gradle@v4
         with:
           gradle-version: "7.6.4"
 
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
-        with:
-          languages: java-kotlin
-          build-mode: manual
-          # 不写 queries: => 使用 CodeQL 默认规则库（default query suite）
-
-      # --------- Build Try 1: Java 17 ----------
       - name: Set up Java 17
-        id: j17
         uses: actions/setup-java@v4
         with:
           distribution: "temurin"
           java-version: "17"
 
-      - name: Build with Java 17
-        id: build17
+      - name: Initialize CodeQL (build mode)
+        uses: github/codeql-action/init@v4
+        with:
+          languages: java-kotlin
+          build-mode: manual
+          # 不写 queries: => 默认规则库（default query suite）
+
+      - name: Build (try)
+        id: build_try
         continue-on-error: true
         shell: bash
         run: |
           set -euxo pipefail
+
           if [ "${{ steps.detect.outputs.build }}" = "gradle" ]; then
             if [ -f "./gradlew" ]; then
               chmod +x ./gradlew
@@ -93,6 +98,7 @@ jobs:
             else
               gradle --no-daemon clean assemble -x test
             fi
+
           elif [ "${{ steps.detect.outputs.build }}" = "maven" ]; then
             if [ -f "./mvnw" ]; then
               chmod +x ./mvnw
@@ -100,46 +106,55 @@ jobs:
             else
               mvn -B -DskipTests package
             fi
+
           else
-            echo "ERROR: No build files (Gradle/Maven) found."
+            echo "No build files found (Gradle/Maven)."
             exit 1
           fi
 
-      # --------- Build Try 2: Java 11 ----------
-      - name: Set up Java 11
-        if: ${{ steps.build17.outcome != 'success' }}
-        id: j11
-        uses: actions/setup-java@v4
-        with:
-          distribution: "temurin"
-          java-version: "11"
-
-      - name: Build with Java 11
-        if: ${{ steps.build17.outcome != 'success' }}
-        id: build11
+      - name: Mark build result
+        id: build_out
         shell: bash
         run: |
-          set -euxo pipefail
-          if [ "${{ steps.detect.outputs.build }}" = "gradle" ]; then
-            if [ -f "./gradlew" ]; then
-              chmod +x ./gradlew
-              ./gradlew --no-daemon clean assemble -x test
-            else
-              gradle --no-daemon clean assemble -x test
-            fi
-          elif [ "${{ steps.detect.outputs.build }}" = "maven" ]; then
-            if [ -f "./mvnw" ]; then
-              chmod +x ./mvnw
-              ./mvnw -B -DskipTests package
-            else
-              mvn -B -DskipTests package
-            fi
+          if [ "${{ steps.build_try.outcome }}" = "success" ]; then
+            echo "build_ok=true" >> "$GITHUB_OUTPUT"
           else
-            echo "ERROR: No build files (Gradle/Maven) found."
-            exit 1
+            echo "build_ok=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Perform CodeQL Analysis
+      - name: Perform CodeQL Analysis (build)
+        if: ${{ steps.build_out.outputs.build_ok == 'true' }}
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:java-kotlin"
+
+  # =========================
+  # 2) 构建失败就“无构建模式”扫描（保证能出结果）
+  # =========================
+  analyze-nobuild:
+    name: Analyze (Java - no-build fallback)
+    needs: analyze-build
+    if: ${{ needs.analyze-build.outputs.build_ok != 'true' }}
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
+          fetch-depth: 0
+
+      - name: Initialize CodeQL (no-build)
+        uses: github/codeql-action/init@v4
+        with:
+          languages: java-kotlin
+          build-mode: none
+
+      - name: Perform CodeQL Analysis (no-build)
         uses: github/codeql-action/analyze@v4
         with:
           category: "/language:java-kotlin"

From 4092ab7ac45f13ddaba8f960fd7f371faee25422 Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 15:56:02 +0800
Subject: [PATCH 06/23] Enhance CodeQL workflow with scan summaries

Updated CodeQL workflow to include summaries for both build and no-build fallback modes.
---
 .github/workflows/codeql1.yml | 45 +++++++++++++++++++++++++++++++----
 1 file changed, 41 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 2eda949..9a43b4d 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -1,4 +1,4 @@
-name: "CodeQL (Java - Default Rules, build fallback to no-build)"
+name: "CodeQL (Java - Default Rules, build fallback + Summary)"
 
 on:
   push:
@@ -44,6 +44,7 @@ jobs:
         shell: bash
         run: |
           set -e
+
           if [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
             echo "build=gradle" >> "$GITHUB_OUTPUT"
           elif [ -f "pom.xml" ]; then
@@ -64,7 +65,7 @@ jobs:
             echo "has_mvnw=false" >> "$GITHUB_OUTPUT"
           fi
 
-      # 没 wrapper 时装一个可控 Gradle（避免系统 Gradle 9.x 带来的 JDK 要求问题）
+      # 没 wrapper 时装一个可控 Gradle（避免系统 Gradle 9.x 造成 JDK/插件兼容问题）
       - name: Setup Gradle (only when no wrapper)
         if: ${{ steps.detect.outputs.build == 'gradle' && steps.detect.outputs.has_gradlew == 'false' }}
         uses: gradle/actions/setup-gradle@v4
@@ -94,9 +95,9 @@ jobs:
           if [ "${{ steps.detect.outputs.build }}" = "gradle" ]; then
             if [ -f "./gradlew" ]; then
               chmod +x ./gradlew
-              ./gradlew --no-daemon clean assemble -x test
+              ./gradlew --no-daemon clean assemble -x test --warning-mode all
             else
-              gradle --no-daemon clean assemble -x test
+              gradle --no-daemon clean assemble -x test --warning-mode all
             fi
 
           elif [ "${{ steps.detect.outputs.build }}" = "maven" ]; then
@@ -128,6 +129,28 @@ jobs:
         with:
           category: "/language:java-kotlin"
 
+      - name: Summary (build mode)
+        shell: bash
+        run: |
+          echo "## 🛡️ CodeQL Scan Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Build tool:** \`${{ steps.detect.outputs.build }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Build wrapper:** gradlew=${{ steps.detect.outputs.has_gradlew }}, mvnw=${{ steps.detect.outputs.has_mvnw }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ "${{ steps.build_out.outputs.build_ok }}" = "true" ]; then
+            echo "**Scan mode:** ✅ Build (manual) + Default rules" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
+            echo "- **Security → Code scanning**（默认更偏向展示默认分支告警）" >> $GITHUB_STEP_SUMMARY
+            echo "- 本次运行日志：*Perform CodeQL Analysis (build)*" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "**Scan mode:** ⚠️ Build failed → will run **no-build fallback** in next job" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "> ℹ️ Build failed. This is expected for some historical tags (old Gradle scripts/plugins)." >> $GITHUB_STEP_SUMMARY
+          fi
+
   # =========================
   # 2) 构建失败就“无构建模式”扫描（保证能出结果）
   # =========================
@@ -158,3 +181,17 @@ jobs:
         uses: github/codeql-action/analyze@v4
         with:
           category: "/language:java-kotlin"
+
+      - name: Summary (no-build fallback)
+        shell: bash
+        run: |
+          echo "## 🛡️ CodeQL Scan Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Scan mode:** ✅ No-build fallback + Default rules" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "> ℹ️ Build failed, but CodeQL still scanned the code in **no-build** mode to ensure results are produced." >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
+          echo "- **Security → Code scanning**（tag 扫描结果可能不会在默认视图立刻显示，需要调整过滤条件）" >> $GITHUB_STEP_SUMMARY
+          echo "- 本次运行日志：*Perform CodeQL Analysis (no-build)*" >> $GITHUB_STEP_SUMMARY

From 91c0d9787f4aa9b18dd1f5caeff63139c5dcce1e Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 16:39:31 +0800
Subject: [PATCH 07/23] Update codeql1.yml

---
 .github/workflows/codeql1.yml | 30 +++++++++++-------------------
 1 file changed, 11 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 9a43b4d..4b60fc6 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -1,4 +1,4 @@
-name: "CodeQL (Java - Default Rules, build fallback + Summary)"
+name: "CodeQL (Java - Security Extended, build fallback + Summary)"
 
 on:
   push:
@@ -44,7 +44,6 @@ jobs:
         shell: bash
         run: |
           set -e
-
           if [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
             echo "build=gradle" >> "$GITHUB_OUTPUT"
           elif [ -f "pom.xml" ]; then
@@ -52,20 +51,18 @@ jobs:
           else
             echo "build=none" >> "$GITHUB_OUTPUT"
           fi
-
           if [ -f "./gradlew" ]; then
             echo "has_gradlew=true" >> "$GITHUB_OUTPUT"
           else
             echo "has_gradlew=false" >> "$GITHUB_OUTPUT"
           fi
-
           if [ -f "./mvnw" ]; then
             echo "has_mvnw=true" >> "$GITHUB_OUTPUT"
           else
             echo "has_mvnw=false" >> "$GITHUB_OUTPUT"
           fi
 
-      # 没 wrapper 时装一个可控 Gradle（避免系统 Gradle 9.x 造成 JDK/插件兼容问题）
+      # 没 wrapper 时装一个可控 Gradle
       - name: Setup Gradle (only when no wrapper)
         if: ${{ steps.detect.outputs.build == 'gradle' && steps.detect.outputs.has_gradlew == 'false' }}
         uses: gradle/actions/setup-gradle@v4
@@ -78,12 +75,12 @@ jobs:
           distribution: "temurin"
           java-version: "17"
 
-      - name: Initialize CodeQL (build mode)
+      - name: Initialize CodeQL (build mode, security-extended)
         uses: github/codeql-action/init@v4
         with:
           languages: java-kotlin
           build-mode: manual
-          # 不写 queries: => 默认规则库（default query suite）
+          queries: security-extended
 
       - name: Build (try)
         id: build_try
@@ -91,7 +88,6 @@ jobs:
         shell: bash
         run: |
           set -euxo pipefail
-
           if [ "${{ steps.detect.outputs.build }}" = "gradle" ]; then
             if [ -f "./gradlew" ]; then
               chmod +x ./gradlew
@@ -99,7 +95,6 @@ jobs:
             else
               gradle --no-daemon clean assemble -x test --warning-mode all
             fi
-
           elif [ "${{ steps.detect.outputs.build }}" = "maven" ]; then
             if [ -f "./mvnw" ]; then
               chmod +x ./mvnw
@@ -107,7 +102,6 @@ jobs:
             else
               mvn -B -DskipTests package
             fi
-
           else
             echo "No build files found (Gradle/Maven)."
             exit 1
@@ -137,22 +131,20 @@ jobs:
           echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
           echo "**Build tool:** \`${{ steps.detect.outputs.build }}\`" >> $GITHUB_STEP_SUMMARY
           echo "**Build wrapper:** gradlew=${{ steps.detect.outputs.has_gradlew }}, mvnw=${{ steps.detect.outputs.has_mvnw }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** ✅ \`security-extended\`" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-
           if [ "${{ steps.build_out.outputs.build_ok }}" = "true" ]; then
-            echo "**Scan mode:** ✅ Build (manual) + Default rules" >> $GITHUB_STEP_SUMMARY
+            echo "**Scan mode:** ✅ Build (manual) + Security Extended rules" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
             echo "- **Security → Code scanning**（默认更偏向展示默认分支告警）" >> $GITHUB_STEP_SUMMARY
             echo "- 本次运行日志：*Perform CodeQL Analysis (build)*" >> $GITHUB_STEP_SUMMARY
           else
             echo "**Scan mode:** ⚠️ Build failed → will run **no-build fallback** in next job" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "> ℹ️ Build failed. This is expected for some historical tags (old Gradle scripts/plugins)." >> $GITHUB_STEP_SUMMARY
           fi
 
   # =========================
-  # 2) 构建失败就“无构建模式”扫描（保证能出结果）
+  # 2) 构建失败就“无构建模式”扫描
   # =========================
   analyze-nobuild:
     name: Analyze (Java - no-build fallback)
@@ -171,11 +163,12 @@ jobs:
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
           fetch-depth: 0
 
-      - name: Initialize CodeQL (no-build)
+      - name: Initialize CodeQL (no-build, security-extended)
         uses: github/codeql-action/init@v4
         with:
           languages: java-kotlin
           build-mode: none
+          queries: security-extended
 
       - name: Perform CodeQL Analysis (no-build)
         uses: github/codeql-action/analyze@v4
@@ -188,9 +181,8 @@ jobs:
           echo "## 🛡️ CodeQL Scan Summary" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "**Scan mode:** ✅ No-build fallback + Default rules" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "> ℹ️ Build failed, but CodeQL still scanned the code in **no-build** mode to ensure results are produced." >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** ✅ \`security-extended\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Scan mode:** ✅ No-build fallback + Security Extended rules" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
           echo "- **Security → Code scanning**（tag 扫描结果可能不会在默认视图立刻显示，需要调整过滤条件）" >> $GITHUB_STEP_SUMMARY

From 6257cde9d38d912ea77f9a675cde4e0e4452189d Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 16:59:15 +0800
Subject: [PATCH 08/23] Update CodeQL workflow for clarity and comments

---
 .github/workflows/codeql1.yml | 126 +++++++++++++++++++++++++++++++---
 1 file changed, 117 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 4b60fc6..4f7dc7f 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -1,12 +1,12 @@
-name: "CodeQL (Java - Security Extended, build fallback + Summary)"
+name: "CodeQL (Java - Security Extended, build fallback + Rule Summary)"
 
 on:
   push:
-    branches: [ "main", "master" ]
+    branches: ["main", "master"]
     tags:
       - "**"
   pull_request:
-    branches: [ "main", "master" ]
+    branches: ["main", "master"]
   workflow_dispatch:
     inputs:
       ref:
@@ -51,18 +51,20 @@ jobs:
           else
             echo "build=none" >> "$GITHUB_OUTPUT"
           fi
+
           if [ -f "./gradlew" ]; then
             echo "has_gradlew=true" >> "$GITHUB_OUTPUT"
           else
             echo "has_gradlew=false" >> "$GITHUB_OUTPUT"
           fi
+
           if [ -f "./mvnw" ]; then
             echo "has_mvnw=true" >> "$GITHUB_OUTPUT"
           else
             echo "has_mvnw=false" >> "$GITHUB_OUTPUT"
           fi
 
-      # 没 wrapper 时装一个可控 Gradle
+      # 没 wrapper 时装一个可控 Gradle（避免系统 Gradle 9.x 造成 JDK/插件兼容问题）
       - name: Setup Gradle (only when no wrapper)
         if: ${{ steps.detect.outputs.build == 'gradle' && steps.detect.outputs.has_gradlew == 'false' }}
         uses: gradle/actions/setup-gradle@v4
@@ -123,7 +125,58 @@ jobs:
         with:
           category: "/language:java-kotlin"
 
+      # ✅ 从 SARIF 里打印“本次 suite 包含哪些规则 / 本次触发哪些规则”
+      - name: Print CodeQL rules used (from SARIF)
+        if: always()
+        shell: bash
+        run: |
+          echo "## 🧾 CodeQL rules used (from SARIF)" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ ! -d "results" ]; then
+            echo "- SARIF folder not found: \`results/\`（可能 build 没成功或 analyze 没执行）" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+
+          shopt -s nullglob
+          FILES=(results/*.sarif)
+          if [ ${#FILES[@]} -eq 0 ]; then
+            echo "- No SARIF files found in \`results/*.sarif\`（可能 analyze 没执行）" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+
+          for SARIF in "${FILES[@]}"; do
+            echo "### 📄 ${SARIF}" >> $GITHUB_STEP_SUMMARY
+
+            TOTAL_RULES=$(jq '[.runs[].tool.driver.rules[]?] | length' "$SARIF" 2>/dev/null || echo "0")
+            TRIGGERED_RULES=$(jq '[.runs[].results[]? | .ruleId] | unique | length' "$SARIF" 2>/dev/null || echo "0")
+
+            echo "- Rules in SARIF: **$TOTAL_RULES**" >> $GITHUB_STEP_SUMMARY
+            echo "- Rules triggered (alerts exist): **$TRIGGERED_RULES**" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+
+            echo "<details><summary>✅ 展开：本次 suite 的全部规则 ruleId</summary>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            jq -r '.runs[].tool.driver.rules[]?.id' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            echo "</details>" >> $GITHUB_STEP_SUMMARY
+
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "<details><summary>🔥 展开：本次实际触发告警的 ruleId（有 results）</summary>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            jq -r '.runs[].results[]?.ruleId' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            echo "</details>" >> $GITHUB_STEP_SUMMARY
+
+            echo "" >> $GITHUB_STEP_SUMMARY
+          done
+
       - name: Summary (build mode)
+        if: always()
         shell: bash
         run: |
           echo "## 🛡️ CodeQL Scan Summary" >> $GITHUB_STEP_SUMMARY
@@ -131,20 +184,23 @@ jobs:
           echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
           echo "**Build tool:** \`${{ steps.detect.outputs.build }}\`" >> $GITHUB_STEP_SUMMARY
           echo "**Build wrapper:** gradlew=${{ steps.detect.outputs.has_gradlew }}, mvnw=${{ steps.detect.outputs.has_mvnw }}" >> $GITHUB_STEP_SUMMARY
-          echo "**Query suite:** ✅ \`security-extended\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
+
           if [ "${{ steps.build_out.outputs.build_ok }}" = "true" ]; then
-            echo "**Scan mode:** ✅ Build (manual) + Security Extended rules" >> $GITHUB_STEP_SUMMARY
+            echo "**Scan mode:** ✅ Build (manual) + security-extended" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
             echo "- **Security → Code scanning**（默认更偏向展示默认分支告警）" >> $GITHUB_STEP_SUMMARY
             echo "- 本次运行日志：*Perform CodeQL Analysis (build)*" >> $GITHUB_STEP_SUMMARY
           else
             echo "**Scan mode:** ⚠️ Build failed → will run **no-build fallback** in next job" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "> ℹ️ Build failed. Some historical tags use very old Gradle/Maven settings; fallback will still produce results." >> $GITHUB_STEP_SUMMARY
           fi
 
   # =========================
-  # 2) 构建失败就“无构建模式”扫描
+  # 2) 构建失败就“无构建模式”扫描（保证能出结果）
   # =========================
   analyze-nobuild:
     name: Analyze (Java - no-build fallback)
@@ -175,14 +231,66 @@ jobs:
         with:
           category: "/language:java-kotlin"
 
+      - name: Print CodeQL rules used (from SARIF)
+        if: always()
+        shell: bash
+        run: |
+          echo "## 🧾 CodeQL rules used (from SARIF)" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ ! -d "results" ]; then
+            echo "- SARIF folder not found: \`results/\`" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+
+          shopt -s nullglob
+          FILES=(results/*.sarif)
+          if [ ${#FILES[@]} -eq 0 ]; then
+            echo "- No SARIF files found in \`results/*.sarif\`" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+
+          for SARIF in "${FILES[@]}"; do
+            echo "### 📄 ${SARIF}" >> $GITHUB_STEP_SUMMARY
+
+            TOTAL_RULES=$(jq '[.runs[].tool.driver.rules[]?] | length' "$SARIF" 2>/dev/null || echo "0")
+            TRIGGERED_RULES=$(jq '[.runs[].results[]? | .ruleId] | unique | length' "$SARIF" 2>/dev/null || echo "0")
+
+            echo "- Rules in SARIF: **$TOTAL_RULES**" >> $GITHUB_STEP_SUMMARY
+            echo "- Rules triggered (alerts exist): **$TRIGGERED_RULES**" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+
+            echo "<details><summary>✅ 展开：本次 suite 的全部规则 ruleId</summary>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            jq -r '.runs[].tool.driver.rules[]?.id' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            echo "</details>" >> $GITHUB_STEP_SUMMARY
+
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "<details><summary>🔥 展开：本次实际触发告警的 ruleId（有 results）</summary>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            jq -r '.runs[].results[]?.ruleId' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            echo "</details>" >> $GITHUB_STEP_SUMMARY
+
+            echo "" >> $GITHUB_STEP_SUMMARY
+          done
+
       - name: Summary (no-build fallback)
+        if: always()
         shell: bash
         run: |
           echo "## 🛡️ CodeQL Scan Summary" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "**Query suite:** ✅ \`security-extended\`" >> $GITHUB_STEP_SUMMARY
-          echo "**Scan mode:** ✅ No-build fallback + Security Extended rules" >> $GITHUB_STEP_SUMMARY
+          echo "**Scan mode:** ✅ No-build fallback + security-extended" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "> ℹ️ Build failed, but CodeQL still scanned the code in **no-build** mode to ensure results are produced." >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
           echo "- **Security → Code scanning**（tag 扫描结果可能不会在默认视图立刻显示，需要调整过滤条件）" >> $GITHUB_STEP_SUMMARY

From 88c91d26180a2f9e16eff3b6da9c5f4fb5cdf92f Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 17:10:37 +0800
Subject: [PATCH 09/23] Refactor CodeQL workflow for better readability

---
 .github/workflows/codeql1.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 4f7dc7f..74332a1 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -51,13 +51,11 @@ jobs:
           else
             echo "build=none" >> "$GITHUB_OUTPUT"
           fi
-
           if [ -f "./gradlew" ]; then
             echo "has_gradlew=true" >> "$GITHUB_OUTPUT"
           else
             echo "has_gradlew=false" >> "$GITHUB_OUTPUT"
           fi
-
           if [ -f "./mvnw" ]; then
             echo "has_mvnw=true" >> "$GITHUB_OUTPUT"
           else
@@ -213,8 +211,7 @@ jobs:
       security-events: write
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
           fetch-depth: 0

From fbe88c6fc0f3ea0a0da8dfe1fcd9c9b6aba0762d Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 17:16:16 +0800
Subject: [PATCH 10/23] Enhance CodeQL workflow with SARIF checks

Added checks for SARIF folder and files in CodeQL workflow.
---
 .github/workflows/codeql1.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 74332a1..de8125b 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -133,6 +133,8 @@ jobs:
           echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
+          # Check if the SARIF folder exists
+          echo "Checking if SARIF files are generated..." >> $GITHUB_STEP_SUMMARY
           if [ ! -d "results" ]; then
             echo "- SARIF folder not found: \`results/\`（可能 build 没成功或 analyze 没执行）" >> $GITHUB_STEP_SUMMARY
             exit 0
@@ -145,6 +147,9 @@ jobs:
             exit 0
           fi
 
+          echo "SARIF files found in results/:" >> $GITHUB_STEP_SUMMARY
+          ls -l results/ >> $GITHUB_STEP_SUMMARY  # List the contents of the results folder
+
           for SARIF in "${FILES[@]}"; do
             echo "### 📄 ${SARIF}" >> $GITHUB_STEP_SUMMARY
 
@@ -228,6 +233,7 @@ jobs:
         with:
           category: "/language:java-kotlin"
 
+      # Print SARIF output content
       - name: Print CodeQL rules used (from SARIF)
         if: always()
         shell: bash

From fc767340900be3cbbd589ef280715cc44fc0c32f Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 17:23:50 +0800
Subject: [PATCH 11/23] Refactor CodeQL SARIF file checks and output

Updated the CodeQL workflow to improve SARIF file handling and output details about triggered rules.
---
 .github/workflows/codeql1.yml | 39 ++++++-----------------------------
 1 file changed, 6 insertions(+), 33 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index de8125b..020b94a 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -123,7 +123,7 @@ jobs:
         with:
           category: "/language:java-kotlin"
 
-      # ✅ 从 SARIF 里打印“本次 suite 包含哪些规则 / 本次触发哪些规则”
+      # ✅ 打印查询规则的详细信息（包括触发的规则）
       - name: Print CodeQL rules used (from SARIF)
         if: always()
         shell: bash
@@ -133,51 +133,24 @@ jobs:
           echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
-          # Check if the SARIF folder exists
-          echo "Checking if SARIF files are generated..." >> $GITHUB_STEP_SUMMARY
+          # GitHub 自动上传的 SARIF 文件不会保存到 `results/`，它们会直接通过 GitHub 的 API 上传
+          echo "Checking if SARIF files are uploaded..." >> $GITHUB_STEP_SUMMARY
+          
           if [ ! -d "results" ]; then
             echo "- SARIF folder not found: \`results/\`（可能 build 没成功或 analyze 没执行）" >> $GITHUB_STEP_SUMMARY
-            exit 0
+            exit 1
           fi
 
           shopt -s nullglob
           FILES=(results/*.sarif)
           if [ ${#FILES[@]} -eq 0 ]; then
             echo "- No SARIF files found in \`results/*.sarif\`（可能 analyze 没执行）" >> $GITHUB_STEP_SUMMARY
-            exit 0
+            exit 1
           fi
 
           echo "SARIF files found in results/:" >> $GITHUB_STEP_SUMMARY
           ls -l results/ >> $GITHUB_STEP_SUMMARY  # List the contents of the results folder
 
-          for SARIF in "${FILES[@]}"; do
-            echo "### 📄 ${SARIF}" >> $GITHUB_STEP_SUMMARY
-
-            TOTAL_RULES=$(jq '[.runs[].tool.driver.rules[]?] | length' "$SARIF" 2>/dev/null || echo "0")
-            TRIGGERED_RULES=$(jq '[.runs[].results[]? | .ruleId] | unique | length' "$SARIF" 2>/dev/null || echo "0")
-
-            echo "- Rules in SARIF: **$TOTAL_RULES**" >> $GITHUB_STEP_SUMMARY
-            echo "- Rules triggered (alerts exist): **$TRIGGERED_RULES**" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-
-            echo "<details><summary>✅ 展开：本次 suite 的全部规则 ruleId</summary>" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-            jq -r '.runs[].tool.driver.rules[]?.id' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-            echo "</details>" >> $GITHUB_STEP_SUMMARY
-
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "<details><summary>🔥 展开：本次实际触发告警的 ruleId（有 results）</summary>" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-            jq -r '.runs[].results[]?.ruleId' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-            echo "</details>" >> $GITHUB_STEP_SUMMARY
-
-            echo "" >> $GITHUB_STEP_SUMMARY
-          done
-
       - name: Summary (build mode)
         if: always()
         shell: bash

From 03c28dcedbf8ec0f0a320352796b73b4f90f618f Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 17:31:58 +0800
Subject: [PATCH 12/23] Update codeql1.yml

---
 .github/workflows/codeql1.yml | 114 +++++++---------------------------
 1 file changed, 24 insertions(+), 90 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 020b94a..2384eb8 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -123,90 +123,28 @@ jobs:
         with:
           category: "/language:java-kotlin"
 
-      # ✅ 打印查询规则的详细信息（包括触发的规则）
-      - name: Print CodeQL rules used (from SARIF)
-        if: always()
-        shell: bash
+      # =========================
+      # 新增检查 SARIF 文件是否生成的步骤
+      # =========================
+      - name: Verify SARIF output folder
         run: |
-          echo "## 🧾 CodeQL rules used (from SARIF)" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          # GitHub 自动上传的 SARIF 文件不会保存到 `results/`，它们会直接通过 GitHub 的 API 上传
-          echo "Checking if SARIF files are uploaded..." >> $GITHUB_STEP_SUMMARY
-          
+          echo "Checking if SARIF files are generated..."
           if [ ! -d "results" ]; then
-            echo "- SARIF folder not found: \`results/\`（可能 build 没成功或 analyze 没执行）" >> $GITHUB_STEP_SUMMARY
+            echo "- SARIF folder not found: \`results/\`" >> $GITHUB_STEP_SUMMARY
             exit 1
           fi
 
           shopt -s nullglob
           FILES=(results/*.sarif)
           if [ ${#FILES[@]} -eq 0 ]; then
-            echo "- No SARIF files found in \`results/*.sarif\`（可能 analyze 没执行）" >> $GITHUB_STEP_SUMMARY
+            echo "- No SARIF files found in \`results/*.sarif\`" >> $GITHUB_STEP_SUMMARY
             exit 1
           fi
 
           echo "SARIF files found in results/:" >> $GITHUB_STEP_SUMMARY
           ls -l results/ >> $GITHUB_STEP_SUMMARY  # List the contents of the results folder
 
-      - name: Summary (build mode)
-        if: always()
-        shell: bash
-        run: |
-          echo "## 🛡️ CodeQL Scan Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "**Build tool:** \`${{ steps.detect.outputs.build }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "**Build wrapper:** gradlew=${{ steps.detect.outputs.has_gradlew }}, mvnw=${{ steps.detect.outputs.has_mvnw }}" >> $GITHUB_STEP_SUMMARY
-          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          if [ "${{ steps.build_out.outputs.build_ok }}" = "true" ]; then
-            echo "**Scan mode:** ✅ Build (manual) + security-extended" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
-            echo "- **Security → Code scanning**（默认更偏向展示默认分支告警）" >> $GITHUB_STEP_SUMMARY
-            echo "- 本次运行日志：*Perform CodeQL Analysis (build)*" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "**Scan mode:** ⚠️ Build failed → will run **no-build fallback** in next job" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "> ℹ️ Build failed. Some historical tags use very old Gradle/Maven settings; fallback will still produce results." >> $GITHUB_STEP_SUMMARY
-          fi
-
-  # =========================
-  # 2) 构建失败就“无构建模式”扫描（保证能出结果）
-  # =========================
-  analyze-nobuild:
-    name: Analyze (Java - no-build fallback)
-    needs: analyze-build
-    if: ${{ needs.analyze-build.outputs.build_ok != 'true' }}
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-      security-events: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
-          fetch-depth: 0
-
-      - name: Initialize CodeQL (no-build, security-extended)
-        uses: github/codeql-action/init@v4
-        with:
-          languages: java-kotlin
-          build-mode: none
-          queries: security-extended
-
-      - name: Perform CodeQL Analysis (no-build)
-        uses: github/codeql-action/analyze@v4
-        with:
-          category: "/language:java-kotlin"
-
-      # Print SARIF output content
+      # 继续分析并输出 SARIF 文件内容
       - name: Print CodeQL rules used (from SARIF)
         if: always()
         shell: bash
@@ -216,19 +154,7 @@ jobs:
           echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
-          if [ ! -d "results" ]; then
-            echo "- SARIF folder not found: \`results/\`" >> $GITHUB_STEP_SUMMARY
-            exit 0
-          fi
-
-          shopt -s nullglob
-          FILES=(results/*.sarif)
-          if [ ${#FILES[@]} -eq 0 ]; then
-            echo "- No SARIF files found in \`results/*.sarif\`" >> $GITHUB_STEP_SUMMARY
-            exit 0
-          fi
-
-          for SARIF in "${FILES[@]}"; do
+          for SARIF in results/*.sarif; do
             echo "### 📄 ${SARIF}" >> $GITHUB_STEP_SUMMARY
 
             TOTAL_RULES=$(jq '[.runs[].tool.driver.rules[]?] | length' "$SARIF" 2>/dev/null || echo "0")
@@ -256,18 +182,26 @@ jobs:
             echo "" >> $GITHUB_STEP_SUMMARY
           done
 
-      - name: Summary (no-build fallback)
+      - name: Summary (build mode)
         if: always()
         shell: bash
         run: |
           echo "## 🛡️ CodeQL Scan Summary" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "**Scan mode:** ✅ No-build fallback + security-extended" >> $GITHUB_STEP_SUMMARY
+          echo "**Build tool:** \`${{ steps.detect.outputs.build }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Build wrapper:** gradlew=${{ steps.detect.outputs.has_gradlew }}, mvnw=${{ steps.detect.outputs.has_mvnw }}" >> $GITHUB_STEP_SUMMARY
           echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "> ℹ️ Build failed, but CodeQL still scanned the code in **no-build** mode to ensure results are produced." >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
-          echo "- **Security → Code scanning**（tag 扫描结果可能不会在默认视图立刻显示，需要调整过滤条件）" >> $GITHUB_STEP_SUMMARY
-          echo "- 本次运行日志：*Perform CodeQL Analysis (no-build)*" >> $GITHUB_STEP_SUMMARY
+
+          if [ "${{ steps.build_out.outputs.build_ok }}" = "true" ]; then
+            echo "**Scan mode:** ✅ Build (manual) + security-extended" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
+            echo "- **Security → Code scanning**（默认更偏向展示默认分支告警）" >> $GITHUB_STEP_SUMMARY
+            echo "- 本次运行日志：*Perform CodeQL Analysis (build)*" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "**Scan mode:** ⚠️ Build failed → will run **no-build fallback** in next job" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "> ℹ️ Build failed. Some historical tags use very old Gradle/Maven settings; fallback will still produce results." >> $GITHUB_STEP_SUMMARY
+          fi

From 4d550cc95165f88f7faec216a41f890d99054e9d Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 17:36:36 +0800
Subject: [PATCH 13/23] Simplify CodeQL workflow by removing queries and checks

Removed specific queries and verification steps for SARIF output.
---
 .github/workflows/codeql1.yml | 68 +++--------------------------------
 1 file changed, 5 insertions(+), 63 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 2384eb8..1ae25e9 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -80,7 +80,8 @@ jobs:
         with:
           languages: java-kotlin
           build-mode: manual
-          queries: security-extended
+          # Remove specific queries, so it uses the default rules
+          # queries: security-extended
 
       - name: Build (try)
         id: build_try
@@ -123,65 +124,6 @@ jobs:
         with:
           category: "/language:java-kotlin"
 
-      # =========================
-      # 新增检查 SARIF 文件是否生成的步骤
-      # =========================
-      - name: Verify SARIF output folder
-        run: |
-          echo "Checking if SARIF files are generated..."
-          if [ ! -d "results" ]; then
-            echo "- SARIF folder not found: \`results/\`" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-
-          shopt -s nullglob
-          FILES=(results/*.sarif)
-          if [ ${#FILES[@]} -eq 0 ]; then
-            echo "- No SARIF files found in \`results/*.sarif\`" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-
-          echo "SARIF files found in results/:" >> $GITHUB_STEP_SUMMARY
-          ls -l results/ >> $GITHUB_STEP_SUMMARY  # List the contents of the results folder
-
-      # 继续分析并输出 SARIF 文件内容
-      - name: Print CodeQL rules used (from SARIF)
-        if: always()
-        shell: bash
-        run: |
-          echo "## 🧾 CodeQL rules used (from SARIF)" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          for SARIF in results/*.sarif; do
-            echo "### 📄 ${SARIF}" >> $GITHUB_STEP_SUMMARY
-
-            TOTAL_RULES=$(jq '[.runs[].tool.driver.rules[]?] | length' "$SARIF" 2>/dev/null || echo "0")
-            TRIGGERED_RULES=$(jq '[.runs[].results[]? | .ruleId] | unique | length' "$SARIF" 2>/dev/null || echo "0")
-
-            echo "- Rules in SARIF: **$TOTAL_RULES**" >> $GITHUB_STEP_SUMMARY
-            echo "- Rules triggered (alerts exist): **$TRIGGERED_RULES**" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-
-            echo "<details><summary>✅ 展开：本次 suite 的全部规则 ruleId</summary>" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-            jq -r '.runs[].tool.driver.rules[]?.id' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-            echo "</details>" >> $GITHUB_STEP_SUMMARY
-
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "<details><summary>🔥 展开：本次实际触发告警的 ruleId（有 results）</summary>" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-            jq -r '.runs[].results[]?.ruleId' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-            echo "</details>" >> $GITHUB_STEP_SUMMARY
-
-            echo "" >> $GITHUB_STEP_SUMMARY
-          done
-
       - name: Summary (build mode)
         if: always()
         shell: bash
@@ -191,11 +133,11 @@ jobs:
           echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
           echo "**Build tool:** \`${{ steps.detect.outputs.build }}\`" >> $GITHUB_STEP_SUMMARY
           echo "**Build wrapper:** gradlew=${{ steps.detect.outputs.has_gradlew }}, mvnw=${{ steps.detect.outputs.has_mvnw }}" >> $GITHUB_STEP_SUMMARY
-          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** Default rules" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
           if [ "${{ steps.build_out.outputs.build_ok }}" = "true" ]; then
-            echo "**Scan mode:** ✅ Build (manual) + security-extended" >> $GITHUB_STEP_SUMMARY
+            echo "**Scan mode:** ✅ Build (manual) + Default rules" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
             echo "- **Security → Code scanning**（默认更偏向展示默认分支告警）" >> $GITHUB_STEP_SUMMARY
@@ -204,4 +146,4 @@ jobs:
             echo "**Scan mode:** ⚠️ Build failed → will run **no-build fallback** in next job" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "> ℹ️ Build failed. Some historical tags use very old Gradle/Maven settings; fallback will still produce results." >> $GITHUB_STEP_SUMMARY
-          fi
+

From 8ac587cc5c1328063c2c5dedbec93325a3d398d6 Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 17:40:50 +0800
Subject: [PATCH 14/23] Refactor CodeQL workflow for Gradle and SARIF output

Removed Gradle setup step when no wrapper is present and added SARIF result upload debugging output.
---
 .github/workflows/codeql1.yml | 38 ++++++++++++++++++++++++++---------
 1 file changed, 28 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 1ae25e9..8a060c5 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -62,13 +62,6 @@ jobs:
             echo "has_mvnw=false" >> "$GITHUB_OUTPUT"
           fi
 
-      # 没 wrapper 时装一个可控 Gradle（避免系统 Gradle 9.x 造成 JDK/插件兼容问题）
-      - name: Setup Gradle (only when no wrapper)
-        if: ${{ steps.detect.outputs.build == 'gradle' && steps.detect.outputs.has_gradlew == 'false' }}
-        uses: gradle/actions/setup-gradle@v4
-        with:
-          gradle-version: "7.6.4"
-
       - name: Set up Java 17
         uses: actions/setup-java@v4
         with:
@@ -80,8 +73,7 @@ jobs:
         with:
           languages: java-kotlin
           build-mode: manual
-          # Remove specific queries, so it uses the default rules
-          # queries: security-extended
+          queries: security-extended
 
       - name: Build (try)
         id: build_try
@@ -124,6 +116,33 @@ jobs:
         with:
           category: "/language:java-kotlin"
 
+      # =========================
+      # 增加上传结果调试输出
+      # =========================
+      - name: Upload SARIF results
+        if: always()
+        run: |
+          echo "Uploading SARIF results..." >> $GITHUB_STEP_SUMMARY
+          echo "Results will be uploaded to Code scanning tab" >> $GITHUB_STEP_SUMMARY
+          
+          # 在上传结果后，确保 GitHub 上传的结果
+          echo "Checking if SARIF files are uploaded..." >> $GITHUB_STEP_SUMMARY
+          if [ ! -d "results" ]; then
+            echo "- SARIF folder not found: \`results/\`" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+          shopt -s nullglob
+          FILES=(results/*.sarif)
+          if [ ${#FILES[@]} -eq 0 ]; then
+            echo "- No SARIF files found in \`results/*.sarif\`" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+          # 打印文件内容
+          echo "SARIF files found in results/:" >> $GITHUB_STEP_SUMMARY
+          ls -l results/ >> $GITHUB_STEP_SUMMARY
+
       - name: Summary (build mode)
         if: always()
         shell: bash
@@ -146,4 +165,3 @@ jobs:
             echo "**Scan mode:** ⚠️ Build failed → will run **no-build fallback** in next job" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "> ℹ️ Build failed. Some historical tags use very old Gradle/Maven settings; fallback will still produce results." >> $GITHUB_STEP_SUMMARY
-

From 6be389214e7d76bb59b1200574113b90c35c612a Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 17:46:30 +0800
Subject: [PATCH 15/23] Implement no-build fallback for CodeQL analysis

Added no-build fallback analysis step for CodeQL scans to ensure results are produced even when the build fails.
---
 .github/workflows/codeql1.yml | 104 ++++++++++++++++++++++++++++++++++
 1 file changed, 104 insertions(+)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 8a060c5..801b8df 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -62,6 +62,13 @@ jobs:
             echo "has_mvnw=false" >> "$GITHUB_OUTPUT"
           fi
 
+      # 没 wrapper 时装一个可控 Gradle（避免系统 Gradle 9.x 造成 JDK/插件兼容问题）
+      - name: Setup Gradle (only when no wrapper)
+        if: ${{ steps.detect.outputs.build == 'gradle' && steps.detect.outputs.has_gradlew == 'false' }}
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: "7.6.4"
+
       - name: Set up Java 17
         uses: actions/setup-java@v4
         with:
@@ -165,3 +172,100 @@ jobs:
             echo "**Scan mode:** ⚠️ Build failed → will run **no-build fallback** in next job" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "> ℹ️ Build failed. Some historical tags use very old Gradle/Maven settings; fallback will still produce results." >> $GITHUB_STEP_SUMMARY
+
+  # =========================
+  # 2) 构建失败就“无构建模式”扫描（保证能出结果）
+  # =========================
+  analyze-nobuild:
+    name: Analyze (Java - no-build fallback)
+    needs: analyze-build
+    if: ${{ needs.analyze-build.outputs.build_ok != 'true' }}
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
+          fetch-depth: 0
+
+      - name: Initialize CodeQL (no-build, security-extended)
+        uses: github/codeql-action/init@v4
+        with:
+          languages: java-kotlin
+          build-mode: none
+          queries: security-extended
+
+      - name: Perform CodeQL Analysis (no-build)
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:java-kotlin"
+
+      # Print SARIF output content
+      - name: Print CodeQL rules used (from SARIF)
+        if: always()
+        shell: bash
+        run: |
+          echo "## 🧾 CodeQL rules used (from SARIF)" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ ! -d "results" ]; then
+            echo "- SARIF folder not found: \`results/\`" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+
+          shopt -s nullglob
+          FILES=(results/*.sarif)
+          if [ ${#FILES[@]} -eq 0 ]; then
+            echo "- No SARIF files found in \`results/*.sarif\`" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+
+          for SARIF in "${FILES[@]}"; do
+            echo "### 📄 ${SARIF}" >> $GITHUB_STEP_SUMMARY
+
+            TOTAL_RULES=$(jq '[.runs[].tool.driver.rules[]?] | length' "$SARIF" 2>/dev/null || echo "0")
+            TRIGGERED_RULES=$(jq '[.runs[].results[]? | .ruleId] | unique | length' "$SARIF" 2>/dev/null || echo "0")
+
+            echo "- Rules in SARIF: **$TOTAL_RULES**" >> $GITHUB_STEP_SUMMARY
+            echo "- Rules triggered (alerts exist): **$TRIGGERED_RULES**" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+
+            echo "<details><summary>✅ 展开：本次 suite 的全部规则 ruleId</summary>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            jq -r '.runs[].tool.driver.rules[]?.id' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            echo "</details>" >> $GITHUB_STEP_SUMMARY
+
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "<details><summary>🔥 展开：本次实际触发告警的 ruleId（有 results）</summary>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            jq -r '.runs[].results[]?.ruleId' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            echo "</details>" >> $GITHUB_STEP_SUMMARY
+
+            echo "" >> $GITHUB_STEP_SUMMARY
+          done
+
+      - name: Summary (no-build fallback)
+        if: always()
+        shell: bash
+        run: |
+          echo "## 🛡️ CodeQL Scan Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Scan mode:** ✅ No-build fallback + security-extended" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "> ℹ️ Build failed, but CodeQL still scanned the code in **no-build** mode to ensure results are produced." >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
+          echo "- **Security → Code scanning**（tag 扫描结果可能不会在默认视图立刻显示，需要调整过滤条件）" >> $GITHUB_STEP_SUMMARY
+          echo "- 本次运行日志：*Perform CodeQL Analysis (no-build)*" >> $GITHUB_STEP_SUMMARY

From 90f7e4b917b9321a57059d169ebdbb81a5832228 Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 17:58:54 +0800
Subject: [PATCH 16/23] Remove no-build fallback and Gradle setup steps

Removed no-build fallback analysis steps and Gradle setup when no wrapper is present.
---
 .github/workflows/codeql1.yml | 116 ++--------------------------------
 1 file changed, 7 insertions(+), 109 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 801b8df..093f1a6 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -62,13 +62,6 @@ jobs:
             echo "has_mvnw=false" >> "$GITHUB_OUTPUT"
           fi
 
-      # 没 wrapper 时装一个可控 Gradle（避免系统 Gradle 9.x 造成 JDK/插件兼容问题）
-      - name: Setup Gradle (only when no wrapper)
-        if: ${{ steps.detect.outputs.build == 'gradle' && steps.detect.outputs.has_gradlew == 'false' }}
-        uses: gradle/actions/setup-gradle@v4
-        with:
-          gradle-version: "7.6.4"
-
       - name: Set up Java 17
         uses: actions/setup-java@v4
         with:
@@ -134,21 +127,23 @@ jobs:
           
           # 在上传结果后，确保 GitHub 上传的结果
           echo "Checking if SARIF files are uploaded..." >> $GITHUB_STEP_SUMMARY
-          if [ ! -d "results" ]; then
-            echo "- SARIF folder not found: \`results/\`" >> $GITHUB_STEP_SUMMARY
+          
+          # 这里使用 GITHUB_WORKSPACE 作为路径
+          if [ ! -d "$GITHUB_WORKSPACE/results" ]; then
+            echo "- SARIF folder not found: \`$GITHUB_WORKSPACE/results/\`" >> $GITHUB_STEP_SUMMARY
             exit 1
           fi
 
           shopt -s nullglob
-          FILES=(results/*.sarif)
+          FILES=($GITHUB_WORKSPACE/results/*.sarif)
           if [ ${#FILES[@]} -eq 0 ]; then
-            echo "- No SARIF files found in \`results/*.sarif\`" >> $GITHUB_STEP_SUMMARY
+            echo "- No SARIF files found in \`$GITHUB_WORKSPACE/results/*.sarif\`" >> $GITHUB_STEP_SUMMARY
             exit 1
           fi
 
           # 打印文件内容
           echo "SARIF files found in results/:" >> $GITHUB_STEP_SUMMARY
-          ls -l results/ >> $GITHUB_STEP_SUMMARY
+          ls -l $GITHUB_WORKSPACE/results/ >> $GITHUB_STEP_SUMMARY
 
       - name: Summary (build mode)
         if: always()
@@ -172,100 +167,3 @@ jobs:
             echo "**Scan mode:** ⚠️ Build failed → will run **no-build fallback** in next job" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "> ℹ️ Build failed. Some historical tags use very old Gradle/Maven settings; fallback will still produce results." >> $GITHUB_STEP_SUMMARY
-
-  # =========================
-  # 2) 构建失败就“无构建模式”扫描（保证能出结果）
-  # =========================
-  analyze-nobuild:
-    name: Analyze (Java - no-build fallback)
-    needs: analyze-build
-    if: ${{ needs.analyze-build.outputs.build_ok != 'true' }}
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-      security-events: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
-          fetch-depth: 0
-
-      - name: Initialize CodeQL (no-build, security-extended)
-        uses: github/codeql-action/init@v4
-        with:
-          languages: java-kotlin
-          build-mode: none
-          queries: security-extended
-
-      - name: Perform CodeQL Analysis (no-build)
-        uses: github/codeql-action/analyze@v4
-        with:
-          category: "/language:java-kotlin"
-
-      # Print SARIF output content
-      - name: Print CodeQL rules used (from SARIF)
-        if: always()
-        shell: bash
-        run: |
-          echo "## 🧾 CodeQL rules used (from SARIF)" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          if [ ! -d "results" ]; then
-            echo "- SARIF folder not found: \`results/\`" >> $GITHUB_STEP_SUMMARY
-            exit 0
-          fi
-
-          shopt -s nullglob
-          FILES=(results/*.sarif)
-          if [ ${#FILES[@]} -eq 0 ]; then
-            echo "- No SARIF files found in \`results/*.sarif\`" >> $GITHUB_STEP_SUMMARY
-            exit 0
-          fi
-
-          for SARIF in "${FILES[@]}"; do
-            echo "### 📄 ${SARIF}" >> $GITHUB_STEP_SUMMARY
-
-            TOTAL_RULES=$(jq '[.runs[].tool.driver.rules[]?] | length' "$SARIF" 2>/dev/null || echo "0")
-            TRIGGERED_RULES=$(jq '[.runs[].results[]? | .ruleId] | unique | length' "$SARIF" 2>/dev/null || echo "0")
-
-            echo "- Rules in SARIF: **$TOTAL_RULES**" >> $GITHUB_STEP_SUMMARY
-            echo "- Rules triggered (alerts exist): **$TRIGGERED_RULES**" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-
-            echo "<details><summary>✅ 展开：本次 suite 的全部规则 ruleId</summary>" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-            jq -r '.runs[].tool.driver.rules[]?.id' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-            echo "</details>" >> $GITHUB_STEP_SUMMARY
-
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "<details><summary>🔥 展开：本次实际触发告警的 ruleId（有 results）</summary>" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-            jq -r '.runs[].results[]?.ruleId' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
-            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-            echo "</details>" >> $GITHUB_STEP_SUMMARY
-
-            echo "" >> $GITHUB_STEP_SUMMARY
-          done
-
-      - name: Summary (no-build fallback)
-        if: always()
-        shell: bash
-        run: |
-          echo "## 🛡️ CodeQL Scan Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "**Scan mode:** ✅ No-build fallback + security-extended" >> $GITHUB_STEP_SUMMARY
-          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "> ℹ️ Build failed, but CodeQL still scanned the code in **no-build** mode to ensure results are produced." >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
-          echo "- **Security → Code scanning**（tag 扫描结果可能不会在默认视图立刻显示，需要调整过滤条件）" >> $GITHUB_STEP_SUMMARY
-          echo "- 本次运行日志：*Perform CodeQL Analysis (no-build)*" >> $GITHUB_STEP_SUMMARY

From 3cde306cdc431d7cbcc4092bd7bb1a121846747a Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 18:10:33 +0800
Subject: [PATCH 17/23] Improve SARIF results upload process in CodeQL workflow

Refactor SARIF file upload checks and output messages.
---
 .github/workflows/codeql1.yml | 29 ++++++-----------------------
 1 file changed, 6 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 093f1a6..c42f2b5 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -18,9 +18,6 @@ permissions:
   contents: read
 
 jobs:
-  # =========================
-  # 1) 尝试“构建模式”扫描（更准确）
-  # =========================
   analyze-build:
     name: Analyze (Java - build if possible)
     runs-on: ubuntu-latest
@@ -116,35 +113,21 @@ jobs:
         with:
           category: "/language:java-kotlin"
 
-      # =========================
-      # 增加上传结果调试输出
-      # =========================
       - name: Upload SARIF results
         if: always()
         run: |
           echo "Uploading SARIF results..." >> $GITHUB_STEP_SUMMARY
           echo "Results will be uploaded to Code scanning tab" >> $GITHUB_STEP_SUMMARY
           
-          # 在上传结果后，确保 GitHub 上传的结果
-          echo "Checking if SARIF files are uploaded..." >> $GITHUB_STEP_SUMMARY
-          
-          # 这里使用 GITHUB_WORKSPACE 作为路径
-          if [ ! -d "$GITHUB_WORKSPACE/results" ]; then
-            echo "- SARIF folder not found: \`$GITHUB_WORKSPACE/results/\`" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-
-          shopt -s nullglob
-          FILES=($GITHUB_WORKSPACE/results/*.sarif)
-          if [ ${#FILES[@]} -eq 0 ]; then
-            echo "- No SARIF files found in \`$GITHUB_WORKSPACE/results/*.sarif\`" >> $GITHUB_STEP_SUMMARY
+          # 检查是否存在 SARIF 文件
+          if [ ! -f "${{ github.workspace }}/results/java.sarif" ]; then
+            echo "- SARIF file not found: \`${{ github.workspace }}/results/java.sarif\`" >> $GITHUB_STEP_SUMMARY
             exit 1
           fi
 
-          # 打印文件内容
-          echo "SARIF files found in results/:" >> $GITHUB_STEP_SUMMARY
-          ls -l $GITHUB_WORKSPACE/results/ >> $GITHUB_STEP_SUMMARY
-
+          echo "SARIF file found at ${{ github.workspace }}/results/java.sarif" >> $GITHUB_STEP_SUMMARY
+          ls -l ${{ github.workspace }}/results/ >> $GITHUB_STEP_SUMMARY
+          
       - name: Summary (build mode)
         if: always()
         shell: bash

From f18f0ad94f8055e8c9d60544c4be46df7f80b351 Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 18:19:13 +0800
Subject: [PATCH 18/23] Update codeql1.yml

---
 .github/workflows/codeql1.yml | 25 ++++++++-----------------
 1 file changed, 8 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index c42f2b5..b016cf0 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -18,6 +18,9 @@ permissions:
   contents: read
 
 jobs:
+  # =========================
+  # 1) 尝试“构建模式”扫描（更准确）
+  # =========================
   analyze-build:
     name: Analyze (Java - build if possible)
     runs-on: ubuntu-latest
@@ -113,21 +116,9 @@ jobs:
         with:
           category: "/language:java-kotlin"
 
-      - name: Upload SARIF results
-        if: always()
-        run: |
-          echo "Uploading SARIF results..." >> $GITHUB_STEP_SUMMARY
-          echo "Results will be uploaded to Code scanning tab" >> $GITHUB_STEP_SUMMARY
-          
-          # 检查是否存在 SARIF 文件
-          if [ ! -f "${{ github.workspace }}/results/java.sarif" ]; then
-            echo "- SARIF file not found: \`${{ github.workspace }}/results/java.sarif\`" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-
-          echo "SARIF file found at ${{ github.workspace }}/results/java.sarif" >> $GITHUB_STEP_SUMMARY
-          ls -l ${{ github.workspace }}/results/ >> $GITHUB_STEP_SUMMARY
-          
+      # =========================
+      # 2) 构建失败时跳过上传（不需要再次上传）
+      # =========================
       - name: Summary (build mode)
         if: always()
         shell: bash
@@ -137,11 +128,11 @@ jobs:
           echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
           echo "**Build tool:** \`${{ steps.detect.outputs.build }}\`" >> $GITHUB_STEP_SUMMARY
           echo "**Build wrapper:** gradlew=${{ steps.detect.outputs.has_gradlew }}, mvnw=${{ steps.detect.outputs.has_mvnw }}" >> $GITHUB_STEP_SUMMARY
-          echo "**Query suite:** Default rules" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** security-extended" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
           if [ "${{ steps.build_out.outputs.build_ok }}" = "true" ]; then
-            echo "**Scan mode:** ✅ Build (manual) + Default rules" >> $GITHUB_STEP_SUMMARY
+            echo "**Scan mode:** ✅ Build (manual) + security-extended" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
             echo "- **Security → Code scanning**（默认更偏向展示默认分支告警）" >> $GITHUB_STEP_SUMMARY

From dc5e633deea20fe09649b22e408351f52ed096e0 Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 18:35:29 +0800
Subject: [PATCH 19/23] Refactor CodeQL workflow for clarity and updates

---
 .github/workflows/codeql1.yml | 115 +++++++++++++++++-----------------
 1 file changed, 56 insertions(+), 59 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index b016cf0..3a91992 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -1,4 +1,4 @@
-name: "CodeQL (Java - Security Extended, build fallback + Rule Summary)"
+name: "CodeQL (Java - Security Extended + Build Fallback + Scan Summary)"
 
 on:
   push:
@@ -16,19 +16,12 @@ on:
 
 permissions:
   contents: read
+  security-events: write
 
 jobs:
-  # =========================
-  # 1) 尝试“构建模式”扫描（更准确）
-  # =========================
   analyze-build:
-    name: Analyze (Java - build if possible)
+    name: Analyze (Build if possible)
     runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-      security-events: write
-
     outputs:
       build_ok: ${{ steps.build_out.outputs.build_ok }}
 
@@ -36,39 +29,28 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
           fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
 
       - name: Detect build system
         id: detect
-        shell: bash
         run: |
           set -e
           if [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
-            echo "build=gradle" >> "$GITHUB_OUTPUT"
+            echo "build=gradle" >> $GITHUB_OUTPUT
           elif [ -f "pom.xml" ]; then
-            echo "build=maven" >> "$GITHUB_OUTPUT"
-          else
-            echo "build=none" >> "$GITHUB_OUTPUT"
-          fi
-          if [ -f "./gradlew" ]; then
-            echo "has_gradlew=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "has_gradlew=false" >> "$GITHUB_OUTPUT"
-          fi
-          if [ -f "./mvnw" ]; then
-            echo "has_mvnw=true" >> "$GITHUB_OUTPUT"
+            echo "build=maven" >> $GITHUB_OUTPUT
           else
-            echo "has_mvnw=false" >> "$GITHUB_OUTPUT"
+            echo "build=none" >> $GITHUB_OUTPUT
           fi
 
       - name: Set up Java 17
         uses: actions/setup-java@v4
         with:
-          distribution: "temurin"
+          distribution: temurin
           java-version: "17"
 
-      - name: Initialize CodeQL (build mode, security-extended)
+      - name: Initialize CodeQL (security-extended)
         uses: github/codeql-action/init@v4
         with:
           languages: java-kotlin
@@ -78,36 +60,23 @@ jobs:
       - name: Build (try)
         id: build_try
         continue-on-error: true
-        shell: bash
         run: |
           set -euxo pipefail
           if [ "${{ steps.detect.outputs.build }}" = "gradle" ]; then
-            if [ -f "./gradlew" ]; then
-              chmod +x ./gradlew
-              ./gradlew --no-daemon clean assemble -x test --warning-mode all
-            else
-              gradle --no-daemon clean assemble -x test --warning-mode all
-            fi
+            chmod +x ./gradlew || true
+            ./gradlew --no-daemon clean assemble -x test --warning-mode all
           elif [ "${{ steps.detect.outputs.build }}" = "maven" ]; then
-            if [ -f "./mvnw" ]; then
-              chmod +x ./mvnw
-              ./mvnw -B -DskipTests package
-            else
-              mvn -B -DskipTests package
-            fi
-          else
-            echo "No build files found (Gradle/Maven)."
-            exit 1
+            chmod +x ./mvnw || true
+            mvn -B -DskipTests package
           fi
 
       - name: Mark build result
         id: build_out
-        shell: bash
         run: |
           if [ "${{ steps.build_try.outcome }}" = "success" ]; then
-            echo "build_ok=true" >> "$GITHUB_OUTPUT"
+            echo "build_ok=true" >> $GITHUB_OUTPUT
           else
-            echo "build_ok=false" >> "$GITHUB_OUTPUT"
+            echo "build_ok=false" >> $GITHUB_OUTPUT
           fi
 
       - name: Perform CodeQL Analysis (build)
@@ -116,9 +85,6 @@ jobs:
         with:
           category: "/language:java-kotlin"
 
-      # =========================
-      # 2) 构建失败时跳过上传（不需要再次上传）
-      # =========================
       - name: Summary (build mode)
         if: always()
         shell: bash
@@ -126,18 +92,49 @@ jobs:
           echo "## 🛡️ CodeQL Scan Summary" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "**Build tool:** \`${{ steps.detect.outputs.build }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "**Build wrapper:** gradlew=${{ steps.detect.outputs.has_gradlew }}, mvnw=${{ steps.detect.outputs.has_mvnw }}" >> $GITHUB_STEP_SUMMARY
-          echo "**Query suite:** security-extended" >> $GITHUB_STEP_SUMMARY
+          echo "**Build system:** \`${{ steps.detect.outputs.build }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
           if [ "${{ steps.build_out.outputs.build_ok }}" = "true" ]; then
             echo "**Scan mode:** ✅ Build (manual) + security-extended" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
-            echo "- **Security → Code scanning**（默认更偏向展示默认分支告警）" >> $GITHUB_STEP_SUMMARY
-            echo "- 本次运行日志：*Perform CodeQL Analysis (build)*" >> $GITHUB_STEP_SUMMARY
+            echo "- Results are uploaded automatically by CodeQL action." >> $GITHUB_STEP_SUMMARY
+            echo "- See **Security → Code scanning** for alerts." >> $GITHUB_STEP_SUMMARY
           else
-            echo "**Scan mode:** ⚠️ Build failed → will run **no-build fallback** in next job" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "> ℹ️ Build failed. Some historical tags use very old Gradle/Maven settings; fallback will still produce results." >> $GITHUB_STEP_SUMMARY
+            echo "**Scan mode:** ⚠️ Build failed — Falling back to no‑build scan." >> $GITHUB_STEP_SUMMARY
+          fi
+
+  analyze-nobuild:
+    name: Analyze (No‑Build Fallback)
+    needs: analyze-build
+    if: ${{ needs.analyze-build.outputs.build_ok != 'true' }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
+
+      - name: Initialize CodeQL (no‑build)
+        uses: github/codeql-action/init@v4
+        with:
+          languages: java-kotlin
+          build-mode: none
+          queries: security-extended
+
+      - name: Perform CodeQL Analysis (no‑build)
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:java-kotlin"
+
+      - name: Summary (no‑build)
+        shell: bash
+        run: |
+          echo "## 🛡️ CodeQL Scan Summary (No‑Build)" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Scan mode:** ⚠️ No‑build fallback + security‑extended" >> $GITHUB_STEP_SUMMARY
+          echo "- Results are uploaded automatically." >> $GITHUB_STEP_SUMMARY
+          echo "- See **Security → Code scanning** for alerts." >> $GITHUB_STEP_SUMMARY

From 209b211162e4b65df036aef830efec0fa8bb85c9 Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 18:48:09 +0800
Subject: [PATCH 20/23] Fix formatting issues in CodeQL workflow YAML

---
 .github/workflows/codeql1.yml | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 3a91992..42eb942 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -1,4 +1,4 @@
-name: "CodeQL (Java - Security Extended + Build Fallback + Scan Summary)"
+ame: "CodeQL (Java - Security Extended + Build Fallback + Scan Summary)"
 
 on:
   push:
@@ -43,7 +43,6 @@ jobs:
           else
             echo "build=none" >> $GITHUB_OUTPUT
           fi
-
       - name: Set up Java 17
         uses: actions/setup-java@v4
         with:
@@ -69,7 +68,6 @@ jobs:
             chmod +x ./mvnw || true
             mvn -B -DskipTests package
           fi
-
       - name: Mark build result
         id: build_out
         run: |
@@ -78,7 +76,6 @@ jobs:
           else
             echo "build_ok=false" >> $GITHUB_OUTPUT
           fi
-
       - name: Perform CodeQL Analysis (build)
         if: ${{ steps.build_out.outputs.build_ok == 'true' }}
         uses: github/codeql-action/analyze@v4
@@ -95,7 +92,6 @@ jobs:
           echo "**Build system:** \`${{ steps.detect.outputs.build }}\`" >> $GITHUB_STEP_SUMMARY
           echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-
           if [ "${{ steps.build_out.outputs.build_ok }}" = "true" ]; then
             echo "**Scan mode:** ✅ Build (manual) + security-extended" >> $GITHUB_STEP_SUMMARY
             echo "- Results are uploaded automatically by CodeQL action." >> $GITHUB_STEP_SUMMARY
@@ -103,7 +99,6 @@ jobs:
           else
             echo "**Scan mode:** ⚠️ Build failed — Falling back to no‑build scan." >> $GITHUB_STEP_SUMMARY
           fi
-
   analyze-nobuild:
     name: Analyze (No‑Build Fallback)
     needs: analyze-build

From 34bc8b2a88d73562f05686c068bf2f9eb8b9212f Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 18:49:08 +0800
Subject: [PATCH 21/23] Update codeql1.yml

---
 .github/workflows/codeql1.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 42eb942..9b5c32c 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -1,4 +1,4 @@
-ame: "CodeQL (Java - Security Extended + Build Fallback + Scan Summary)"
+name: "CodeQL (Java - Security Extended + Build Fallback + Scan Summary)"
 
 on:
   push:

From 86db1e2afcfd302eff1425be36c2b5dbe5a3a077 Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 19:08:36 +0800
Subject: [PATCH 22/23] Fix echo command for CodeQL summary output

---
 .github/workflows/codeql1.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/codeql1.yml b/.github/workflows/codeql1.yml
index 9b5c32c..3a91992 100644
--- a/.github/workflows/codeql1.yml
+++ b/.github/workflows/codeql1.yml
@@ -43,6 +43,7 @@ jobs:
           else
             echo "build=none" >> $GITHUB_OUTPUT
           fi
+
       - name: Set up Java 17
         uses: actions/setup-java@v4
         with:
@@ -68,6 +69,7 @@ jobs:
             chmod +x ./mvnw || true
             mvn -B -DskipTests package
           fi
+
       - name: Mark build result
         id: build_out
         run: |
@@ -76,6 +78,7 @@ jobs:
           else
             echo "build_ok=false" >> $GITHUB_OUTPUT
           fi
+
       - name: Perform CodeQL Analysis (build)
         if: ${{ steps.build_out.outputs.build_ok == 'true' }}
         uses: github/codeql-action/analyze@v4
@@ -92,6 +95,7 @@ jobs:
           echo "**Build system:** \`${{ steps.detect.outputs.build }}\`" >> $GITHUB_STEP_SUMMARY
           echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
+
           if [ "${{ steps.build_out.outputs.build_ok }}" = "true" ]; then
             echo "**Scan mode:** ✅ Build (manual) + security-extended" >> $GITHUB_STEP_SUMMARY
             echo "- Results are uploaded automatically by CodeQL action." >> $GITHUB_STEP_SUMMARY
@@ -99,6 +103,7 @@ jobs:
           else
             echo "**Scan mode:** ⚠️ Build failed — Falling back to no‑build scan." >> $GITHUB_STEP_SUMMARY
           fi
+
   analyze-nobuild:
     name: Analyze (No‑Build Fallback)
     needs: analyze-build

From f4be8bad9d03d8719d098e44dcfd0e12c49f4e15 Mon Sep 17 00:00:00 2001
From: cjxiong <cjxiong0@163.com>
Date: Mon, 19 Jan 2026 19:17:07 +0800
Subject: [PATCH 23/23] Add CodeQL workflow for Java with fallback analysis

---
 .github/workflows/codeql19.yml | 272 +++++++++++++++++++++++++++++++++
 1 file changed, 272 insertions(+)
 create mode 100644 .github/workflows/codeql19.yml

diff --git a/.github/workflows/codeql19.yml b/.github/workflows/codeql19.yml
new file mode 100644
index 0000000..5308d8f
--- /dev/null
+++ b/.github/workflows/codeql19.yml
@@ -0,0 +1,272 @@
+name: "CodeQL (Java - Security Extended, build fallback + Rule Summary)"
+
+on:
+  push:
+    branches: ["main", "master"]
+    tags:
+      - "**"
+  pull_request:
+    branches: ["main", "master"]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "要扫描的分支或 Tag（例如：master / v1.2.3）"
+        required: true
+        default: "master"
+
+permissions:
+  contents: read
+
+jobs:
+  # =========================
+  # 1) 尝试“构建模式”扫描（更准确）
+  # =========================
+  analyze-build:
+    name: Analyze (Java - build if possible)
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+
+    outputs:
+      build_ok: ${{ steps.build_out.outputs.build_ok }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
+          fetch-depth: 0
+
+      - name: Detect build system
+        id: detect
+        shell: bash
+        run: |
+          set -e
+          if [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
+            echo "build=gradle" >> "$GITHUB_OUTPUT"
+          elif [ -f "pom.xml" ]; then
+            echo "build=maven" >> "$GITHUB_OUTPUT"
+          else
+            echo "build=none" >> "$GITHUB_OUTPUT"
+          fi
+          if [ -f "./gradlew" ]; then
+            echo "has_gradlew=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_gradlew=false" >> "$GITHUB_OUTPUT"
+          fi
+          if [ -f "./mvnw" ]; then
+            echo "has_mvnw=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_mvnw=false" >> "$GITHUB_OUTPUT"
+          fi
+      # 没 wrapper 时装一个可控 Gradle（避免系统 Gradle 9.x 造成 JDK/插件兼容问题）
+      - name: Setup Gradle (only when no wrapper)
+        if: ${{ steps.detect.outputs.build == 'gradle' && steps.detect.outputs.has_gradlew == 'false' }}
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: "7.6.4"
+
+      - name: Set up Java 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: "temurin"
+          java-version: "17"
+
+      - name: Initialize CodeQL (build mode, security-extended)
+        uses: github/codeql-action/init@v4
+        with:
+          languages: java-kotlin
+          build-mode: manual
+          queries: security-extended
+
+      - name: Build (try)
+        id: build_try
+        continue-on-error: true
+        shell: bash
+        run: |
+          set -euxo pipefail
+          if [ "${{ steps.detect.outputs.build }}" = "gradle" ]; then
+            if [ -f "./gradlew" ]; then
+              chmod +x ./gradlew
+              ./gradlew --no-daemon clean assemble -x test --warning-mode all
+            else
+              gradle --no-daemon clean assemble -x test --warning-mode all
+            fi
+          elif [ "${{ steps.detect.outputs.build }}" = "maven" ]; then
+            if [ -f "./mvnw" ]; then
+              chmod +x ./mvnw
+              ./mvnw -B -DskipTests package
+            else
+              mvn -B -DskipTests package
+            fi
+          else
+            echo "No build files found (Gradle/Maven)."
+            exit 1
+          fi
+      - name: Mark build result
+        id: build_out
+        shell: bash
+        run: |
+          if [ "${{ steps.build_try.outcome }}" = "success" ]; then
+            echo "build_ok=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "build_ok=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Perform CodeQL Analysis (build)
+        if: ${{ steps.build_out.outputs.build_ok == 'true' }}
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:java-kotlin"
+
+      # ✅ 从 SARIF 里打印“本次 suite 包含哪些规则 / 本次触发哪些规则”
+      - name: Print CodeQL rules used (from SARIF)
+        if: always()
+        shell: bash
+        run: |
+          echo "## 🧾 CodeQL rules used (from SARIF)" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          if [ ! -d "results" ]; then
+            echo "- SARIF folder not found: \`results/\`（可能 build 没成功或 analyze 没执行）" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+          shopt -s nullglob
+          FILES=(results/*.sarif)
+          if [ ${#FILES[@]} -eq 0 ]; then
+            echo "- No SARIF files found in \`results/*.sarif\`（可能 analyze 没执行）" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+          for SARIF in "${FILES[@]}"; do
+            echo "### 📄 ${SARIF}" >> $GITHUB_STEP_SUMMARY
+            TOTAL_RULES=$(jq '[.runs[].tool.driver.rules[]?] | length' "$SARIF" 2>/dev/null || echo "0")
+            TRIGGERED_RULES=$(jq '[.runs[].results[]? | .ruleId] | unique | length' "$SARIF" 2>/dev/null || echo "0")
+            echo "- Rules in SARIF: **$TOTAL_RULES**" >> $GITHUB_STEP_SUMMARY
+            echo "- Rules triggered (alerts exist): **$TRIGGERED_RULES**" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "<details><summary>✅ 展开：本次 suite 的全部规则 ruleId</summary>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            jq -r '.runs[].tool.driver.rules[]?.id' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            echo "</details>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "<details><summary>🔥 展开：本次实际触发告警的 ruleId（有 results）</summary>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            jq -r '.runs[].results[]?.ruleId' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            echo "</details>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+          done
+      - name: Summary (build mode)
+        if: always()
+        shell: bash
+        run: |
+          echo "## 🛡️ CodeQL Scan Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Build tool:** \`${{ steps.detect.outputs.build }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Build wrapper:** gradlew=${{ steps.detect.outputs.has_gradlew }}, mvnw=${{ steps.detect.outputs.has_mvnw }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          if [ "${{ steps.build_out.outputs.build_ok }}" = "true" ]; then
+            echo "**Scan mode:** ✅ Build (manual) + security-extended" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
+            echo "- **Security → Code scanning**（默认更偏向展示默认分支告警）" >> $GITHUB_STEP_SUMMARY
+            echo "- 本次运行日志：*Perform CodeQL Analysis (build)*" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "**Scan mode:** ⚠️ Build failed → will run **no-build fallback** in next job" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "> ℹ️ Build failed. Some historical tags use very old Gradle/Maven settings; fallback will still produce results." >> $GITHUB_STEP_SUMMARY
+          fi
+  # =========================
+  # 2) 构建失败就“无构建模式”扫描（保证能出结果）
+  # =========================
+  analyze-nobuild:
+    name: Analyze (Java - no-build fallback)
+    needs: analyze-build
+    if: ${{ needs.analyze-build.outputs.build_ok != 'true' }}
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref }}
+          fetch-depth: 0
+
+      - name: Initialize CodeQL (no-build, security-extended)
+        uses: github/codeql-action/init@v4
+        with:
+          languages: java-kotlin
+          build-mode: none
+          queries: security-extended
+
+      - name: Perform CodeQL Analysis (no-build)
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:java-kotlin"
+
+      - name: Print CodeQL rules used (from SARIF)
+        if: always()
+        shell: bash
+        run: |
+          echo "## 🧾 CodeQL rules used (from SARIF)" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          if [ ! -d "results" ]; then
+            echo "- SARIF folder not found: \`results/\`" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+          shopt -s nullglob
+          FILES=(results/*.sarif)
+          if [ ${#FILES[@]} -eq 0 ]; then
+            echo "- No SARIF files found in \`results/*.sarif\`" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+          for SARIF in "${FILES[@]}"; do
+            echo "### 📄 ${SARIF}" >> $GITHUB_STEP_SUMMARY
+            TOTAL_RULES=$(jq '[.runs[].tool.driver.rules[]?] | length' "$SARIF" 2>/dev/null || echo "0")
+            TRIGGERED_RULES=$(jq '[.runs[].results[]? | .ruleId] | unique | length' "$SARIF" 2>/dev/null || echo "0")
+            echo "- Rules in SARIF: **$TOTAL_RULES**" >> $GITHUB_STEP_SUMMARY
+            echo "- Rules triggered (alerts exist): **$TRIGGERED_RULES**" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "<details><summary>✅ 展开：本次 suite 的全部规则 ruleId</summary>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            jq -r '.runs[].tool.driver.rules[]?.id' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            echo "</details>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "<details><summary>🔥 展开：本次实际触发告警的 ruleId（有 results）</summary>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            jq -r '.runs[].results[]?.ruleId' "$SARIF" | sort -u >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            echo "</details>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+          done
+      - name: Summary (no-build fallback)
+        if: always()
+        shell: bash
+        run: |
+          echo "## 🛡️ CodeQL Scan Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Ref:** \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Scan mode:** ✅ No-build fallback + security-extended" >> $GITHUB_STEP_SUMMARY
+          echo "**Query suite:** \`security-extended\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "> ℹ️ Build failed, but CodeQL still scanned the code in **no-build** mode to ensure results are produced." >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### 🔍 Where to view results" >> $GITHUB_STEP_SUMMARY
+          echo "- **Security → Code scanning**（tag 扫描结果可能不会在默认视图立刻显示，需要调整过滤条件）" >> $GITHUB_STEP_SUMMARY
+          echo "- 本次运行日志：*Perform CodeQL Analysis (no-build)*" >> $GITHUB_STEP_SUMMARY