Java: remove SpringBootActuators query

[jcogs33]

Description

This PR removes the githubsecuritylab/java/spring-boot-exposed-actuators query. This query was added to the default code scanning query suite by github/codeql#18793 and released in CodeQL 2.21.0.

I will make follow-up PRs to update package dependencies for 2.21.0 (draft PR) and to publish a new release.

Consideration

• Does this need a change note? I see a Change notes section in CONTRIBUTING.md, but since the linked guide does not exist, I'm not sure if a change note is needed.
• I have not contributed to this repo before, so let me know if there's anything else I need to do.

(cc @michaelnebel)

[Copilot]

Pull Request Overview

This PR removes the Spring Boot Actuators query by deleting two files that define both test and configuration code for actuator endpoints, aligning the codebase with the updated CodeQL query suite.

• Removed test file for Spring Boot actuator security from java/test/security/CWE-016.
• Removed Spring Boot actuator configuration classes from java/src/security/CWE-016.

Reviewed Changes

Copilot reviewed 2 out of 7 changed files in this pull request and generated no comments.

File	Description
java/test/security/CWE-016/SpringBootActuators.java	Removed test code for actuator endpoint security
java/src/security/CWE-016/SpringBootActuators.java	Removed actuator security configuration classes

Files not reviewed (5)

• java/src/security/CWE-016/SpringBootActuators.qhelp: Language not supported
• java/src/security/CWE-016/SpringBootActuators.ql: Language not supported
• java/src/security/CWE-016/SpringBootActuators.qll: Language not supported
• java/test/security/CWE-016/SpringBootActuators.expected: Language not supported
• java/test/security/CWE-016/SpringBootActuators.qlref: Language not supported

[michaelnebel]

LGTM!

[michaelnebel]

I will make follow-up PRs to update package dependencies for 2.21.0 (draft PR) and to publish a new release.
Excellent!

Does this need a change note? I see a Change notes section in CONTRIBUTING.md, but since the linked guide does not exist, I'm not sure if a change note is needed.

Good question. It appears that this guide was merged around the time, where we added the experimental queries in the first place (at that time we didn't make any change notes). My best guess is that we don't need to add a change note (as this part of the documentation is dangling/unfinished). In any case, maybe ask in #codeql-community-packs on slack (the section in Contributing file should either be deleted or extended with the missing parts).

[jcogs33]

In any case, maybe ask in #codeql-community-packs on slack

Will do, thanks!

[jcogs33]

@michaelnebel A change note is not required. The section in the Contributing file will be deleted in #127.

Can you merge this PR for me? Or give me access to merge in this repo? I don't have an option to merge, I just see:

Merging is blocked
You're not authorized to push to this branch. Visit https://docs.github.com/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches for more information.
Code scanning is waiting for results from CodeQL for the commits 7de4b4b or 798d8ed.

[michaelnebel]

@michaelnebel A change note is not required. The section in the Contributing file will be deleted in #127.

Can you merge this PR for me? Or give me access to merge in this repo? I don't have an option to merge, I just see:

Merging is blocked
You're not authorized to push to this branch. Visit https://docs.github.com/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches for more information.
Code scanning is waiting for results from CodeQL for the commits 7de4b4b or 798d8ed.

I have added you as maintainer. Maybe it should be done properly as part of entitlements (maybe ask for permission in the slack channel - this is probably up to SecLab).

[jcogs33]

I have added you as maintainer.

Thanks! I have access to push to the repo now, but I still see:

Merging is blocked
Code scanning is waiting for results from CodeQL for the commits 7de4b4b or 798d8ed.

Do you know what needs to be done to resolve that message?

[michaelnebel]

I have added you as maintainer.

Thanks! I have access to push to the repo now, but I still see:

Merging is blocked
Code scanning is waiting for results from CodeQL for the commits 7de4b4b or 798d8ed.

Do you know what needs to be done to resolve that message?

Haven't seen that before; Maybe the CodeQL workflow wasn't triggered when the PR was made since you didn't have the right permissions at that time. Maybe rebase and push again.

[jcogs33]

Haven't seen that before; Maybe the CodeQL workflow wasn't triggered when the PR was made since you didn't have the right permissions at that time. Maybe rebase and push again.

I've rebased but am still seeing the same message. 🤔 I'll ask about this in the slack channel.

[michaelnebel]

Haven't seen that before; Maybe the CodeQL workflow wasn't triggered when the PR was made since you didn't have the right permissions at that time. Maybe rebase and push again.

I've rebased but am still seeing the same message. 🤔 I'll ask about this in the slack channel.

Its odd - the CodeQL workflow is not triggered at all.
Maybe consider opening a new PR since we changed the permissions. Alternatively we can ignore this - the CodeQL analysis will not tell us anything - as this PR is deleting a QL query.