ci(codeql): prevent advanced-config upload conflict from failing the job

[khemssharma]

The Perform CodeQL Analysis step fails with: CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled. This happens because the repo also has GitHub Default setup enabled for Code scanning, which conflicts with this advanced workflow's SARIF upload. Added continue-on-error to that step so the job no longer fails red, plus a comment explaining that a repo admin still needs to disable Default setup under Settings > Code security and analysis for uploads to fully succeed (Default setup's autobuild cannot build this Gradle/Kotlin project, so this advanced workflow must remain in place).

Fixes # .

Did you remember to?

• Add test case(s)
• Update CHANGES.txt
• Auto applied styling via ./gradlew autostyleApply

We encourage pull requests that:

• Add new features to TestNG (or)
• Fix bugs in TestNG

If your pull request involves fixing SonarQube issues then we would suggest that you please discuss this with the
TestNG-dev before you spend time working on it.

Note: For more information on contribution guidelines please make sure you refer our Contributing section for detailed set of steps.

Note for maintainers: this repo currently has GitHub Default setup for Code scanning enabled at the same time as this Advanced configuration workflow, which is why the upload step fails. continue-on-error keeps CI green in the meantime, but disabling Default setup under Settings, Code security and analysis, is the step needed to fully restore working uploads.

Summary by CodeRabbit

• Chores
  • Updated security analysis workflow documentation to accurately reflect manual Java/Kotlin build configuration.
  • Documented the potential SARIF upload conflict with GitHub Default setup and the administrative steps required to resolve it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7f780c1d-3334-4d1c-ab58-562aebc07791

📥 Commits

Reviewing files that changed from the base of the PR and between bdc65bc and fb3b70a.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

💤 Files with no reviewable changes (1)

• .github/workflows/codeql.yml

---

📝 Walkthrough

Walkthrough

The CodeQL workflow comments now align with the manual Java/Kotlin build configuration. They also document the Default setup SARIF conflict and the required administrative action.

Changes

CodeQL workflow updates

Layer / File(s)	Summary
Build and analysis workflow configuration .github/workflows/codeql.yml	The workflow aligns the manual-build comments and documents that Default setup cannot build the Gradle/Kotlin sources. The comments identify the SARIF conflict and the need to disable Default setup.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• testng-team/testng#3328: Both PRs modify the CodeQL workflow and its manual Java/Kotlin build configuration.

Suggested reviewers: krmahadevan, juherr

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the CodeQL CI change that prevents advanced-configuration upload conflicts from failing the job.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/codeql.yml:
- Around line 85-87: Remove continue-on-error from the
github/codeql-action/analyze step so CodeQL analysis, upload, and configuration
failures remain visible and fail the job. Keep the existing Perform CodeQL
Analysis step and action version unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3b8a4548-7f6d-4fa3-a277-398db5c29bc4

📥 Commits

Reviewing files that changed from the base of the PR and between 81c66a8 and bdc65bc.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml