codeql.yml

name: "CodeQL"

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  merge_group:
    types: [ checks_requested ]
  schedule:
    - cron: '40 15 * * 4'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name != 'schedule' }}

env:
  NDK_VERSION: "30.0.14904198"

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
        - language: actions
          build-mode: none
        - language: java-kotlin
          build-mode: autobuild
    steps:
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Set up JDK 21
      if: matrix.language == 'java-kotlin'
      uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
      with:
        java-version: '21'
        distribution: 'temurin'

    - name: Set up Android SDK
      if: matrix.language == 'java-kotlin'
      uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1

    - name: Install Android NDK
      if: matrix.language == 'java-kotlin'
      run: |
        sdkmanager --install "ndk;${NDK_VERSION}"
        echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/${NDK_VERSION}" >> "$GITHUB_ENV"
        echo "ANDROID_NDK_ROOT=$ANDROID_HOME/ndk/${NDK_VERSION}" >> "$GITHUB_ENV"

    - name: Cache Gradle packages
      if: matrix.language == 'java-kotlin'
      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: |
          ~/.gradle/caches
          ~/.gradle/wrapper
        key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
        restore-keys: |
          ${{ runner.os }}-gradle-

    - name: Initialize CodeQL
      uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}

    - name: Run manual build steps
      if: matrix.build-mode == 'manual'
      shell: bash
      run: |
        echo 'If you are using a "manual" build mode for one or more of the' \
          'languages you are analyzing, replace this with the commands to build' \
          'your code, for example:'
        echo '  make bootstrap'
        echo '  make release'
        exit 1

    - name: Decode Keystore
      if: matrix.language == 'java-kotlin'
      env:
        RELEASE_KEYSTORE_FILE_BASE64: ${{ secrets.RELEASE_KEYSTORE_FILE }}
      run: |
        printf '%s' "$RELEASE_KEYSTORE_FILE_BASE64" | tr -d '\n\r' | base64 -d > "$HOME/release.keystore"
        echo "KEYSTORE_FILE=$HOME/release.keystore" >> "$GITHUB_ENV"

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
      with:
        category: "/language:${{matrix.language}}"
      env:
        KEYSTORE_FILE: ${{ env.KEYSTORE_FILE }}
        KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
        KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
        KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}