app-masking POC

.github/workflows/detekt.yml

@@ -1,116 +1,76 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-# This workflow performs a static analysis of your Kotlin source code using
-# Detekt.
-#
-# Scans are triggered:
-# 1. On every push to default and protected branches
-# 2. On every Pull Request targeting the default branch
-# 3. On a weekly schedule
-# 4. Manually, on demand, via the "workflow_dispatch" event
-#
-# The workflow should work with no modifications, but you might like to use a
-# later version of the Detekt CLI by modifying the $DETEKT_RELEASE_TAG
-# environment variable.
-name: Scan with Detekt
+name: Detekt Analysis
 
 on:
-  # Triggers the workflow on push or pull request events but only for default and protected branches
-  push:
-    branches: [ "master" ]
+  # Triggers on push to key branches
+#  push:
+#    branches: #[ "master", "stable", "next", "feature/major-refactor-ui-changes" ]
+#      - '**' # Triggers on pull requests to any branch
   pull_request:
-    branches: [ "master" ]
-  schedule:
+    branches:
+      - '**' # Triggers on pull requests to any branch
+  schedule: # Scheduled weekly scan
      - cron: '35 5 * * 0'
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
-env:
-  # Release tag associated with version of Detekt to be installed
-  # SARIF support (required for this workflow) was introduced in Detekt v1.15.0
-  DETEKT_RELEASE_TAG: v1.22.0
-  DETEKT_RELEASE: 1.22.0
-
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
-  # This workflow contains a single job called "scan"
-  scan:
-    name: Scan
-    # The type of runner that the job will run on
+  detekt:
+    name: Static Code Analysis with Detekt
     runs-on: ubuntu-latest
 
-    # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-    - uses: actions/checkout@v3
+    # ✅ Step 1: Checkout Repository
+    - name: Check out code
+      uses: actions/checkout@v5
 
-    # Gets the download URL associated with the $DETEKT_RELEASE_TAG
-    - name: Get Detekt download URL
-      id: detekt_info
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        gh api graphql --field tagName=$DETEKT_RELEASE_TAG --raw-field query='
-          query getReleaseAssetDownloadUrl($tagName: String!) {
-            repository(name: "detekt", owner: "detekt") {
-              release(tagName: $tagName) {
-                releaseAssets(name: "detekt", first: 1) {
-                  nodes {
-                    downloadUrl
-                  }
-                }
-                tagCommit {
-                  oid
-                }
-              }
-            }
-          }
-        ' 1> gh_response.json
+    # ✅ Step 2: Set up Java 17
+    - name: Set up JDK 17
+      uses: actions/setup-java@v5
+      with:
+        distribution: 'temurin'
+        java-version: '17'
 
-        DETEKT_RELEASE_SHA=$(jq --raw-output '.data.repository.release.releaseAssets' gh_response.json)
-        if [ $DETEKT_RELEASE_SHA != "4b1da0d5feb53d9ae9b80193ad49c5597d7c4b42" ]; then
-          echo "Release tag doesn't match expected commit SHA"
-          exit 1
-        fi
-        cat gh_response.json
-        DETEKT_DOWNLOAD_URL=https://github.com/detekt/detekt/releases/download/$DETEKT_RELEASE_TAG/detekt-cli-$DETEKT_RELEASE-all.jar
-        echo $DETEKT_DOWNLOAD_URL
-        echo "download_url=$DETEKT_DOWNLOAD_URL" >> $GITHUB_OUTPUT
+    # ✅ Step 3: Install Ruby and Bundler (Required for Fastlane)
+    - name: Install Ruby and Bundler
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: '3.3'
+        bundler-cache: true
 
-    # Sets up and runs the detekt cli
-    - name: Setup and Run Detekt
-      continue-on-error: true
-      id: detekt_setup_and_run
+    - name: Create local.properties file
       run: |
-        curl --request GET \
-          --url ${{ steps.detekt_info.outputs.download_url }} \
-          --silent \
-          --location \
-          --output detekt.jar
-        chmod a+x detekt.jar
-        # Performs static analysis using Detekt
-        java -jar "detekt.jar" --input ${{ github.workspace }} --all-rules --report sarif:${{ github.workspace }}/detekt.sarif.json
+        echo "MIXPANEL_KEY=${{ secrets.MIXPANEL_KEY }}" >> local.properties
+        echo "STOREFILE=${{ secrets.STOREFILE }}" >> local.properties
+        echo "STOREPASSWORD=${{ secrets.STOREPASSWORD }}" >> local.properties
+        echo "KEYALIAS=${{ secrets.KEYALIAS }}" >> local.properties
+        echo "KEYPASSWORD=${{ secrets.KEYPASSWORD }}" >> local.properties
+
 
-    # Modifies the SARIF output produced by Detekt so that absolute URIs are relative
-    # This is so we can easily map results onto their source files
-    # This can be removed once relative URI support lands in Detekt: https://git.io/JLBbA
-    - name: Make artifact location URIs relative
-      continue-on-error: true
+      # ✅ Step 4: Install Fastlane Dependencies
+    - name: Install Fastlane dependencies
       run: |
-        echo "$(
-          jq \
-            --arg github_workspace ${{ github.workspace }} \
-            '. | ( .runs[].results[].locations[].physicalLocation.artifactLocation.uri |= if test($github_workspace) then .[($github_workspace | length | . + 1):] else . end )' \
-            ${{ github.workspace }}/detekt.sarif.json
-        )" > ${{ github.workspace }}/detekt.sarif.json
+        bundle config path vendor/bundle
+        bundle install --jobs 4 --retry 3
+
+    # ✅ Step 5: Run Detekt via Fastlane
+    - name: Run Detekt
+      run: |
+        bundle exec fastlane detekt
+
+      # ✅ Step 6: Upload SARIF report for GitHub Security Code Scanning
+    - name: Upload SARIF report for GitHub Code Scanning
+      uses: github/codeql-action/upload-sarif@v4
+      with:
+        sarif_file: "app/build/reports/detekt/detekt.sarif"
+        category: detekt-analysis
 
-    # Uploads results to GitHub repository using the upload-sarif action
-    - uses: github/codeql-action/upload-sarif@v2
+    # ✅ Step 7: Upload Detekt Reports as Artifacts for Download
+    - name: Upload Detekt Reports as Artifacts
+      uses: actions/upload-artifact@v4
       with:
-        # Path to SARIF file relative to the root of the repository
-        sarif_file: ${{ github.workspace }}/detekt.sarif.json
-        checkout_path: ${{ github.workspace }}
+        name: detekt-reports
+        path: |
+          */build/reports/detekt/*.html
+          */build/reports/detekt/*.md
+          */build/reports/detekt/*.xml

.gitignore

@@ -55,3 +55,9 @@ fastlane/.env
 /app/release/baselineProfiles/0/save-unspecified-release.dm
 /app/release/baselineProfiles/1/save-unspecified-release.dm
 /app/release/output-metadata.json
+/app/src/main/assets/.env
+/.kotlin/sessions/kotlin-compiler-1215430679833621634.salive
+/.kotlin/
+/app/release/
+/app/prod/
+/app/prod/release/save-unspecified-prod-release.aab