CodeQL Advanced #41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL Advanced | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| schedule: | |
| - cron: '16 14 * * 2' | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} | |
| permissions: | |
| security-events: write | |
| packages: read | |
| actions: read | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: actions | |
| build-mode: none | |
| - language: java-kotlin | |
| build-mode: manual | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| # JDK is required for CodeQL Java/Kotlin analysis and Gradle | |
| - name: Set up JDK 17 | |
| if: matrix.language == 'java-kotlin' | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '17' | |
| distribution: 'temurin' | |
| # Optional but helps with Gradle performance and wrapper verification | |
| - name: Setup Gradle | |
| if: matrix.language == 'java-kotlin' | |
| uses: gradle/actions/setup-gradle@v4 | |
| # Android SDK for Gradle builds (compileSdk 36, build-tools 35.0.0) | |
| - name: Setup Android SDK | |
| if: matrix.language == 'java-kotlin' | |
| uses: android-actions/setup-android@v3 | |
| - name: Install Android SDK components | |
| if: matrix.language == 'java-kotlin' | |
| shell: bash | |
| run: | | |
| sdkmanager --install \ | |
| "platforms;android-36" \ | |
| "build-tools;35.0.0" \ | |
| "platform-tools" | |
| yes | sdkmanager --licenses | |
| # Project-specific files required for successful configuration/build | |
| - name: Prepare project files | |
| if: matrix.language == 'java-kotlin' | |
| shell: bash | |
| run: | | |
| chmod +x gradlew | |
| # Provide placeholder local.properties with required MAPS_API_KEY | |
| echo "MAPS_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" > local.properties | |
| # Provide google-services config expected by the app module | |
| if [ -f "google-services.json.example" ]; then | |
| cp -f google-services.json.example app/google-services.json || true | |
| fi | |
| # Initializes the CodeQL tools for scanning. | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| queries: security-extended,security-and-quality | |
| # For compiled languages, try to build automatically | |
| - name: Autobuild | |
| if: matrix.build-mode == 'autobuild' | |
| uses: github/codeql-action/autobuild@v3 | |
| # If manual build mode is selected, replace the following with your build commands | |
| - name: Build with Gradle (manual for Android) | |
| if: matrix.build-mode == 'manual' | |
| shell: bash | |
| run: | | |
| ./gradlew --version | |
| # Compile app and modules for CodeQL extraction without running tests/lint | |
| ./gradlew :app:assembleDebug -x test -x lint --no-daemon --stacktrace --console=plain | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" |