CodeQL Java分析报错：maven-resources-plugin的outputDirectory参数异常

问题背景 #

我在IntelliJ里给pom.xml的maven-resources-plugin配置了环境变量作为输出目录，配置如下：

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-resources-plugin</artifactId>
    <version>3.2.0</version>
    <executions>
        <execution>
            <id>copy-files-on-build</id>
            <phase>package</phase>
            <goals>
                <goal>copy-resources</goal>
            </goals>
            <configuration>
                <outputDirectory>${PROJECT_OUTPUT}</outputDirectory>
                <resources>
                    <resource>
                        <directory>${basedir}/target</directory>
                        <include>${project.build.finalName}.jar</include>
                        <filtering>false</filtering>
                    </resource>
                </resources>
            </configuration>
        </execution>
    </executions>
</plugin>

但执行CodeQL Analysis时抛出错误：

[2023-08-02 04:52:22] [autobuild] [ERROR] Failed to execute goal org.apache.maven.plugins:maven-resources-plugin:3.3.1:copy-resources (copy-files-on-build) on project PROJECT: The parameters 'outputDirectory' for goal org.apache.maven.plugins:maven-resources-plugin:3.3.1:copy-resources are missing or invalid -> [Help 1]
[2023-08-02 04:52:22] [autobuild] org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.apache.maven.plugins:maven-resources-plugin:3.3.1:copy-resources (copy-files-on-build) on project PROJECT: The parameters 'outputDirectory' for goal org.apache.maven.plugins:maven-resources-plugin:3.3.1:copy-resources are missing or invalid

用绝对路径替换${PROJECT_OUTPUT}就能正常执行分析，想解决这个问题。

解决方案 #

1. 在CodeQL执行环境中注入环境变量 #

CodeQL的自动构建（autobuild）环境不会继承本地IntelliJ的环境变量，需要手动在执行环境里设置：

• 如果用GitHub Actions跑CodeQL，在workflow的job里添加env字段：

  jobs:
    codeql-analysis:
      runs-on: ubuntu-latest
      env:
        PROJECT_OUTPUT: "/path/to/your/target/output/directory"
      steps:
        - uses: actions/checkout@v4
        - name: Initialize CodeQL
          uses: github/codeql-action/init@v2
        - name: Autobuild
          uses: github/codeql-action/autobuild@v2
        - name: Perform CodeQL Analysis
          uses: github/codeql-action/analyze@v2
  

• 如果本地跑CodeQL，执行分析前先导出环境变量：

  export PROJECT_OUTPUT="/path/to/your/target/output/directory"
  # 然后执行CodeQL分析命令
  codeql database create my-db --language=java --command="mvn clean package"
  

2. 给pom.xml的环境变量加默认值 #

在pom.xml里定义一个属性，用环境变量赋值同时指定默认路径，即使环境变量不存在，构建也不会失败：

<properties>
  <!-- 如果PROJECT_OUTPUT环境变量存在就用它，否则用默认的output目录 -->
  <project.output>${env.PROJECT_OUTPUT:-${basedir}/target/output}</project.output>
</properties>

然后把plugin里的outputDirectory改成${project.output}：

<outputDirectory>${project.output}</outputDirectory>

3. 手动指定Maven构建命令，传递参数 #

放弃CodeQL的autobuild，手动执行Maven命令时显式传递PROJECT_OUTPUT参数：

• 本地执行：

  codeql database create my-db --language=java --command="mvn clean package -DPROJECT_OUTPUT=/path/to/your/output/dir"
  

• GitHub Actions里替换autobuild步骤：

  - name: Build with Maven
    run: mvn clean package -DPROJECT_OUTPUT="/path/to/your/output/dir"
  - name: Perform CodeQL Analysis
    uses: github/codeql-action/analyze@v2
  

内容的提问来源于stack exchange，提问作者Chris Haas