ci: keep CodeQL on v4 but drop Kotlin until a CLI ships 2.4.0

The Kotlin 2.4.0 extractor support (github/codeql#21970) is merged but not yet
in a released CodeQL CLI — the latest (2.25.6) still caps at < 2.3.30, so the
java-kotlin job fails regardless of action version. Keep the v4 upgrade (off the
deprecated v3 / Node 20) and scope to c-cpp + actions; the comment records the
exact condition to re-add Kotlin.

Author: George-Cosmin Hanta

.github/workflows/codeql.yml

@@ -8,17 +8,18 @@ on:
   schedule:
     - cron: '23 5 * * 1' # weekly, Monday 05:23 UTC
 
-# CodeQL doesn't support Dart (the bulk of lib/), so this covers the native code:
-# the Android player/HDR Kotlin, the Windows-runner C++ (GDI overlay, HDR badges),
-# and the workflow YAML. Kotlin/C++ are Flutter-driven, so CodeQL's autobuild can't
-# build them — they use `build-mode: manual` with an explicit `flutter build` on
-# their native OS runner.
+# CodeQL doesn't support Dart (the bulk of lib/), so this covers the native code
+# it can: the Windows-runner C++ (GDI overlay, HDR badges) and the workflow YAML.
 #
-# Not covered: javascript-typescript (web/ is only Flutter's generated bootstrap)
-# and swift (the iOS/macOS shells are Flutter template code, no first-party logic).
-#
-# Uses codeql-action v4 — v3 is deprecated (Dec 2026) and its bundled CodeQL CLI
-# predated Kotlin 2.4.0 support (the app is on 2.4.0); v4's CLI includes it.
+# Not covered:
+#   - java-kotlin (the Android player/HDR code): the app is on Kotlin 2.4.0, and
+#     the latest released CodeQL CLI (2.25.6) still caps at < 2.3.30 ("Kotlin
+#     version 2.4.0 is too recent"). Support is merged upstream
+#     (github/codeql#21970) but not yet in a CLI release. Re-add a
+#     `{language: java-kotlin, build-mode: manual}` entry (with setup-java +
+#     `flutter build apk` + `lfs: true`) once a CLI past 2.25.6 ships it.
+#   - javascript-typescript: web/ is only Flutter's generated bootstrap (no source).
+#   - swift: the iOS/macOS shells are Flutter template code (no first-party logic).
 permissions:
   contents: read
 
@@ -38,9 +39,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: java-kotlin
-            build-mode: manual
-            runner: ubuntu-latest
           - language: c-cpp
             build-mode: manual
             runner: windows-latest
@@ -49,35 +47,21 @@ jobs:
             runner: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-        with:
-          # The Kotlin build links the libdovi libmpv AAR (Git LFS).
-          lfs: ${{ matrix.language == 'java-kotlin' }}
 
       - uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
-      # ---- Manual builds: Flutter drives the Kotlin/C++ compilers CodeQL traces ----
-      - if: matrix.language == 'java-kotlin'
-        uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: '17'
-
+      # C++ is Flutter-driven, so CodeQL's autobuild can't build it — run the real
+      # Flutter build under build-mode manual so the tracer sees the compiler.
       - if: matrix.build-mode == 'manual'
         uses: subosito/flutter-action@v2
         with:
           flutter-version: ${{ env.FLUTTER_VERSION }}
           channel: stable
           cache: true
 
-      - name: Build Android (Kotlin)
-        if: matrix.language == 'java-kotlin'
-        run: |
-          flutter pub get
-          flutter build apk --debug
-
       - name: Build Windows (C++)
         if: matrix.language == 'c-cpp'
         run: |