ci: tune codeql for java to use default query pack #9

	---
	# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
	name: CodeQL

	"on":
	workflow_dispatch:
	push:
	branches: [ "main" ]
	pull_request:
	branches: [ "main" ]
	schedule:
	- cron: '44 4 * * 1'

	permissions: {}

	jobs:
	analyze:
	name: Analyze (${{ matrix.language }})
	# Consider using larger runners or machines with greater resources for possible analysis time improvements.
	runs-on: ubuntu-24.04
	permissions:
	security-events: write # integrate with Github Advanced Security

	strategy:
	fail-fast: false
	matrix:
	include:
	- language: actions
	build-mode: none
	queries: security-extended
	- language: python
	build-mode: none
	queries: security-extended
	- language: java
	build-mode: none
	queries: codeql/java-queries # security-extended is very noisy for the java language
	steps:
	- name: Checkout repository
	uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
	with:
	persist-credentials: false

	- name: Configure tools
	uses: ./.github/actions/prepare-for-build

	# Initializes the CodeQL tools for scanning.
	- name: Initialize CodeQL
	uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
	with:
	languages: ${{ matrix.language }}
	build-mode: ${{ matrix.build-mode }}
	queries: ${{ matrix.queries }}

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
	with:
	category: "/language:${{ matrix.language }}"

Provide feedback