What I can gather from the documentation, it seems that the setting should work to a some degree with Java (and C#) if the code is not built, so using buildtype: None should help.
This GitHub Issue links to GitHub Advanced Security documentation (that is the thing that is used underneath)