GroundShare/.github/workflows/codeql.yml at 3f5a7f4e13d0556057054c75ddffd9d6fea6fae3 · Ovalvoi/GroundShare · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
# ---------------------------------------------------------------------------
# CodeQL Analysis — static security analysis for C#, JavaScript/TypeScript, and Java/Kotlin (Android)
# Replaces the GitHub Default Setup which incorrectly tries to build Swift/iOS.
# ---------------------------------------------------------------------------

name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "0 3 * * 1"

permissions:
  contents: read
  security-events: write
  actions: read

jobs:
  analyze-csharp:
    name: Analyze C#
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-dotnet@v6
        with:
          dotnet-version: "8.0.x"

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: csharp
          queries: security-extended
          config-file: ./.github/codeql/codeql-config.yml

      - name: Build
        run: dotnet build src/02-server/GroundShareAPI.csproj -c Release

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: csharp

  analyze-javascript:
    name: Analyze JavaScript/TypeScript
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript
          queries: security-extended
          config-file: ./.github/codeql/codeql-config.yml

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: javascript-typescript

  analyze-java-kotlin:
    name: Analyze Java/Kotlin (Android)
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: "21"

      - uses: actions/setup-node@v7
        with:
          node-version: "22"

      - name: Install npm dependencies
        working-directory: src/03-client
        run: npm ci

      - name: Sync Capacitor Android project
        working-directory: src/03-client
        run: |
          mkdir -p dist
          echo '<!doctype html><title>stub</title>' > dist/index.html
          npx cap sync android

      - name: Create stub google-services.json
        working-directory: src/03-client/android/app
        run: |
          cat > google-services.json <<'EOF'
          {
            "project_info": {
              "project_number": "000000000000",
              "project_id": "groundshare-stub",
              "storage_bucket": "groundshare-stub.appspot.com"
            },
            "client": [
              {
                "client_info": {
                  "mobilesdk_app_id": "1:000000000000:android:0000000000000000",
                  "android_client_info": { "package_name": "com.groundshare.app" }
                },
                "oauth_client": [],
                "api_key": [{ "current_key": "stub" }],
                "services": { "appinvite_service": { "other_platform_oauth_client": [] } }
              }
            ],
            "configuration_version": "1"
          }
          EOF

      - name: Pre-fetch Gradle dependencies
        working-directory: src/03-client/android
        run: ./gradlew dependencies --no-daemon || true

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: java-kotlin
          queries: security-extended
          build-mode: manual
          config-file: ./.github/codeql/codeql-config.yml

      - name: Build Android project (full compile for CodeQL tracing)
        working-directory: src/03-client/android
        run: ./gradlew clean compileDebugSources compileDebugUnitTestSources --no-daemon -x test

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: java-kotlin