Guide: Setting up CodeQL for a mixed Java/Kotlin codebase.

Hey everyone! 👋 I just finished setting up CodeQL for our team's mixed Java/Kotlin microservices, and let me tell you, it was a bit trickier than I expected for a polyglot repo. I wanted to share the key steps and configs that made it work smoothly.

The main hurdle is that CodeQL needs to analyze both languages, and the auto-build detection doesn't always get it right. Here's the core of our `codeql.yml` workflow that handles the setup:

```yaml
name: "CodeQL Advanced"

on:
push:
branches: [ main, develop ]
pull_request:
branches: [ main ]
schedule:
- cron: '30 1 * * 0'

jobs:
analyze:
runs-on: ubuntu-latest
permissions:
security-events: write

strategy:
fail-fast: false
matrix:
language: [ 'java-kotlin' ]

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
build-mode: manual

- name: Setup Java
uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: '17'

- name: Build Project
run: |
# This is a Gradle project
chmod +x gradlew
./gradlew compileJava compileKotlin --no-daemon

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
```

The critical points for a mixed codebase:
* Use the **`java-kotlin`** language identifier. It tells CodeQL to use the combined analysis.
* **Build mode**: We set `build-mode: manual` because our Gradle build needed explicit Java 17 setup. The auto-detection kept picking up an older JDK.
* The build step **must compile both Java and Kotlin sources**. Our `compileJava compileKotlin` targets ensure both language directories are processed.

A few gotchas we ran into:
* If you have a Maven project, ensure the `kotlin-maven-plugin` is correctly configured.
* Memory issues? You might need to add `CODEQL_THREADS: 2` and increase the runner memory for larger projects.
* Keep your CodeQL CLI updated in the workflow. The action handles this, but it's good to check the version occasionally.

The results have been fantastic—catching tricky null pointer risks in Kotlin and some JDBC resource leaks in Java. The dual analysis really leverages the strengths of each language's query pack.

Has anyone else set this up for a similar stack? I'm curious about your experiences with custom query suites or integrating this into pre-commit hooks.

~CloudOps