java/unused-reference-type and java/unused-container: silenced by any annotation, even an empty one #22984

Description of the issue

seed/WRAnnotatedType.java declares an unused private nested class and seed/WRAnnotatedContainer.java a private list that's only written to, and the queries report both. Each file also declares an empty annotation type @interface Tag {}, with no retention and no meaning to any framework. Putting @Tag on the class and on the list (variant/) silences both alerts, though nothing else changed.

The queries treat every annotation except Override, Deprecated, SuppressWarnings and SafeVarargs as a sign of reflective access (ReflectiveAccessAnnotation), even one the program declares itself and nothing reads. The help pages don't mention any annotation exemption.

Query: java/unused-reference-type (codeql/java-queries 1.1.10)

CodeQL CLI: 2.27.2

Code samples

seed/WRAnnotatedContainer.java:

import java.util.ArrayList;
import java.util.List;

class WRAnnotatedContainer {
    @interface Tag {
    }

    private List<String> names = new ArrayList<>();

    void m() {
        names.add("x");
    }
}

seed/WRAnnotatedType.java:

class WRAnnotatedType {
    @interface Tag {
    }

    private class Unused {
    }

    void m() {
    }
}

variant/WRAnnotatedContainer.java:

import java.util.ArrayList;
import java.util.List;

class WRAnnotatedContainer {
    @interface Tag {
    }

    @Tag
    private List<String> names = new ArrayList<>();

    void m() {
        names.add("x");
    }
}

variant/WRAnnotatedType.java:

class WRAnnotatedType {
    @interface Tag {
    }

    @Tag
    private class Unused {
    }

    void m() {
    }
}

How to reproduce

codeql database create db --language=java --build-mode=none \
    --source-root=<one directory> --overwrite
codeql database analyze db \
    codeql/java-queries:codeql-suites/java-security-and-quality.qls \
    --format=csv --output=out.csv
# one database per directory

Expected result

"Unused class" on the annotated Unused in variant/WRAnnotatedType.java and "The contents of this container are never accessed" on names in variant/WRAnnotatedContainer.java, as on the seed/ files. Or, if any annotation is meant to be an exemption, the help pages should say so.

Output of the commands above:

### CodeQL 2.27.2  query: java/unused-reference-type
### suite: java-security-and-quality.qls, --build-mode=none, per-file isolated databases
### extraction JDK: openjdk version "21.0.11" 2026-04-21 LTS

--- SEED -- expected: query fires (seed/)
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Container contents are never accessed","A collection or map whose contents are never queried or accessed is u

--- VARIANT -- expected: query fires, actual: not reported (the bug) (variant/)
    (query reported nothing)