codeql.yml

name: CodeQL

on:
  push:
    branches: [dev]
  pull_request:
    branches: [dev, main]
  schedule:
    - cron: '17 4 * * 1'
  workflow_dispatch:

permissions:
  security-events: write
  packages: read
  actions: read
  contents: read

concurrency:
  group: codeql-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      kmp: ${{ steps.filter.outputs.kmp }}
      website: ${{ steps.filter.outputs.website }}
      workflows: ${{ steps.filter.outputs.workflows }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

      - name: Filter paths
        id: filter
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
        with:
          filters: |
            workflows:
              - '.github/workflows/**'
              - '.github/actions/**'
            website:
              - 'website/**'
            kmp:
              - 'androidApp/**'
              - 'composeApp/**'
              - 'shared/**'
              - 'server/**'
              - 'gradle/**'
              - 'build.gradle.kts'
              - 'settings.gradle.kts'
              - 'gradle.properties'
              - 'gradlew'
              - 'gradlew.bat'

  analyze-jvm-kotlin:
    name: Analyze JVM Kotlin (manual build)
    needs: changes
    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || needs.changes.outputs.kmp == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

      - name: Set up JDK 25
        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
        with:
          distribution: temurin
          java-version: '25'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
        with:
          dependency-graph: disabled

      - name: Set up Android SDK
        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4

      - name: Prepare Android SDK manager
        shell: bash
        run: |
          set -euo pipefail
          (yes || true) | sdkmanager --licenses >/dev/null || true
          sdkmanager "platform-tools"

      - name: Prepare google-services config for CI
        shell: bash
        env:
          GOOGLE_SERVICES_JSON: ${{ secrets.GOOGLE_SERVICES_JSON }}
        run: |
          set -euo pipefail
          if [ -f "androidApp/google-services.json" ]; then
            echo "Found androidApp/google-services.json in workspace."
            exit 0
          fi

          if [ -n "${GOOGLE_SERVICES_JSON:-}" ]; then
            echo "${GOOGLE_SERVICES_JSON}" > androidApp/google-services.json
            echo "Wrote androidApp/google-services.json from repository secret."
            exit 0
          fi

          cat > androidApp/google-services.json <<'JSON'
          {
            "project_info": {
              "project_number": "1234567890",
              "project_id": "ci-placeholder",
              "storage_bucket": "ci-placeholder.appspot.com"
            },
            "client": [
              {
                "client_info": {
                  "mobilesdk_app_id": "1:1234567890:android:abcdef1234567890",
                  "android_client_info": {
                    "package_name": "com.tajemniktv.tajsos"
                  }
                },
                "api_key": [
                  {
                    "current_key": "AIzaSyCIPlaceholderKey"
                  }
                ]
              }
            ],
            "configuration_version": "1"
          }
          JSON

      - name: Initialize CodeQL (java-kotlin)
        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
        with:
          languages: java-kotlin
          build-mode: manual
          queries: security-extended

      - name: Build Kotlin/JVM + Android targets for CodeQL
        shell: bash
        run: |
          ./gradlew \
            -Pandroid.builder.sdkDownload=true \
            --no-build-cache \
            clean \
            :shared:compileKotlinJvm \
            :composeApp:compileKotlinJvm \
            :server:classes \
            :androidApp:assembleDebug \
            --stacktrace \

      - name: Perform CodeQL Analysis (java-kotlin)
        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
        with:
          category: /language:java-kotlin

  analyze-actions:
    name: Analyze GitHub Actions workflows
    needs: changes
    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || needs.changes.outputs.workflows == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

      - name: Initialize CodeQL (actions)
        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
        with:
          languages: actions
          build-mode: none
          queries: security-extended

      - name: Perform CodeQL Analysis (actions)
        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
        with:
          category: /language:actions

  analyze-js-ts:
    name: Analyze website JavaScript/TypeScript
    needs: changes
    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || needs.changes.outputs.website == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

      - name: Initialize CodeQL (javascript-typescript)
        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
        with:
          languages: javascript-typescript
          build-mode: none
          queries: security-extended

      - name: Perform CodeQL Analysis (javascript-typescript)
        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
        with:
          category: /language:javascript-typescript

# Swift is intentionally omitted for now. This repository's iosApp target is a thin wrapper
# and does not have a reliable macOS CI build path yet for CodeQL manual extraction.