From 5ef99700f541993e310e46b4b0551103d306c1d6 Mon Sep 17 00:00:00 2001
From: Vasily Pelikh <2010720+vpelikh@users.noreply.github.com>
Date: Thu, 27 Aug 2026 07:08:13 +0300
Subject: [PATCH] Fix CodeQL Maven lock-timeout and skip tests for analysis

The CodeQL-Build job's Maven install failed with an Aether shared-lock
timeout after 900s because parallel modules (-T 1C) forked test JVMs that
contended on shared reactor artifacts (webmvc-ui, function-webflux-tests,
kotlin-webflux-tests).

- Raise the local-repo lock timeout via -Daether.syncContext.named.time
  in the shared maven-install action.
- Add a skip-tests input to maven-install and enable it for the CodeQL
  build, which only needs compiled classes for analysis.
- Drop the obsolete 'git checkout HEAD^2' step (CodeQL recommends
  analyzing the merge commit).
---
 .github/actions/maven-install/action.yml | 19 ++++++++++++++++++-
 .github/workflows/codeql-analysis.yml    | 10 +++++-----
 2 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/.github/actions/maven-install/action.yml b/.github/actions/maven-install/action.yml
index bf793ae1d..a150e16ae 100644
--- a/.github/actions/maven-install/action.yml
+++ b/.github/actions/maven-install/action.yml
@@ -3,10 +3,27 @@ description: >
   Builds and installs the whole Maven reactor to the local repo, skipping the
   maven-plugin's invoker-plugin integration tests. Those run serially afterwards
   via build-and-test-plugins.
+inputs:
+  skip-tests:
+    description: >
+      Set to 'true' to skip executing unit/integration tests (surefire)
+      during the install. Intended for the CodeQL build, which only needs the
+      compiled classes for analysis.
+    required: false
+    default: 'false'
 runs:
   using: "composite"
   steps:
     - name: Maven install
       shell: bash
+      env:
+        SKIP_TESTS: ${{ inputs.skip-tests }}
       run: |
-        ./mvnw --no-transfer-progress -B -T 1C -Dinvoker.skip=true install --file pom.xml
\ No newline at end of file
+        SKIP_TEST_FLAG=""
+        if [ "$SKIP_TESTS" = "true" ]; then
+          SKIP_TEST_FLAG="-DskipTests"
+        fi
+        # -Daether.syncContext.named.time raises the local-repo lock timeout so
+        # parallel (-T 1C) modules forking test JVMs do not deadlock on shared
+        # reactor artifacts (see CodeQL-Build lock-timeout failures).
+        ./mvnw --no-transfer-progress -B -T 1C -Dinvoker.skip=true -Daether.syncContext.named.time=3000 $SKIP_TEST_FLAG install --file pom.xml
\ No newline at end of file
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index f0c3c7107..606baf51f 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -22,9 +22,6 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 2
-      - run: git checkout HEAD^2
-        if: ${{ github.event_name == 'pull_request' }}
-
       - name: Set up Java
         uses: actions/setup-java@v5
         with:
@@ -38,9 +35,12 @@ jobs:
           languages: java
 
       - name: Build with Maven
-        # CodeQL only needs the source built for analysis; the maven-plugin's invoker
-        # ITs already run in the main Build workflow (see maven-install action).
+        # CodeQL only needs the source built for analysis, so tests are skipped.
+        # The maven-plugin's invoker ITs already run in the main Build workflow
+        # (see the maven-install action used by build-and-test-plugins).
         uses: ./.github/actions/maven-install
+        with:
+          skip-tests: 'true'
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4
\ No newline at end of file