macOS build process fixes and GitHub Actions improvements + CodeQL analysis

[Stereo]

I was doing this with Don-vip, but he tells me he's too busy to have a look at it this week, and to open a ticket.

​https://github.com/openstreetmap/josm/pull/68 improves the macOS build process:

• Fix macOS dock icon resetting to default one. Fetches macOS icon over https (in case we're a jar), saves 77K in the jar. (#20133)
• Fix unreadable macOS tabs (#20075)
• Fix macOS tested build doesn't know it's tested (#20202)
• Better documentation of the macOS build process in the scripts, and better shell syntax
• Allow building of a JOSM.app without having signing keys installed - useful for local builds.

Also:

• Activate CodeQL code quality checks (not macOS-related; Don-vip and I were interested in testing it)

​https://github.com/openstreetmap/josm/pull/68.diff is the raw diff.

The diff without whitespace is more readable: ​https://github.com/openstreetmap/josm/pull/68/files?diff=split&w=1

[Stereo]

Would it please be possible to merge these for 21.01? It's ready to go, and I want to do more interesting things than rebasing JOSM once a month to do manual builds :).

I'd be happy to merge these things myself if given access.

[GerdP]

My understanding is that we will not release a tested version before end of Feb.

[stoecker]

I don't see a reason not to apply these. GerdP, can you?

[GerdP]

In 17487/josm:

see #20257:macOS build process fixes and improvements

• ​apply ​https://github.com/openstreetmap/josm/pull/68.diff without understanding what it does

[GerdP]

@Stereo: Please close the ticket if the patch fixes the problem.

[stoecker]

Replying to GerdP:

without understanding what it does

It's ok as long as the Mac guy understands it and I hope he does ;-)

[GerdP]

In 17488/josm:

see #20257:macOS build process fixes and improvements

• ​fix checkstyle issues

[Stereo]

The Mac guy hopes he understands too! :)

Thanks everyone.

[stoecker]

Milestone renamed

[Don-vip]

In 17545/josm:

see #20257 - JDK-8251377 is fixed in Java 16, make sure we don't mess with default LAF in Java 16+

[Don-vip]

@Stereo CodeQL works nicely, and it detects some real issues, thank you!

[Don-vip]

In 17964/josm:

see #20257 - CodeQL - java/zipslip - Checks for Zip Slip Vulnerability (CWE-22 / path traversal)

[anonymous]

@Don-vip Oh I'm glad to hear that, I'd forgotten about it! Very cool.