codeql.yml

name: "CodeQL Advanced"

on:
  push:
    branches: ["master"]
  pull_request:
    branches: ["master"]
  schedule:
    - cron: "20 20 * * 1"

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: actions
            build-mode: none
          - language: go
            build-mode: autobuild
          - language: java-kotlin
            build-mode: manual
          - language: javascript-typescript
            build-mode: none

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      # Prepare the Android toolchain used by the Kotlin Gradle project.
      - name: Set up JDK for Java
        if: matrix.language == 'java-kotlin'
        uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "25"

      - name: Set up Go for Android build
        if: matrix.language == 'java-kotlin'
        uses: actions/setup-go@v5
        with:
          go-version: "1.27.0"

      - name: Set up pnpm for Android build
        if: matrix.language == 'java-kotlin'
        uses: pnpm/action-setup@v4
        with:
          version: "12.6.0"
          run_install: false

      - name: Set up Node.js for Android build
        if: matrix.language == 'java-kotlin'
        uses: actions/setup-node@v4
        with:
          node-version: "26.7.0"
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Set up Gradle
        if: matrix.language == 'java-kotlin'
        uses: gradle/actions/setup-gradle@v4

      # 不用 android-actions/setup-android@v3：它无条件执行 `sdkmanager tools`，而 runner 镜像
      # 的 cmdline-tools 16.0 已不再提供 `tools` 包，整个 job 会在这一步失败。
      - name: Set up Android SDK
        if: matrix.language == 'java-kotlin'
        shell: bash
        run: |
          {
            echo "ANDROID_HOME=$ANDROID_SDK_ROOT"
            echo "ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT"
          } >> "$GITHUB_ENV"
          {
            echo "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin"
            echo "$ANDROID_SDK_ROOT/cmdline-tools/16.0/bin"
            echo "$ANDROID_SDK_ROOT/platform-tools"
          } >> "$GITHUB_PATH"

      - name: Install Android SDK components
        if: matrix.language == 'java-kotlin'
        shell: bash
        run: |
          { yes || true; } | sdkmanager --licenses >/dev/null
          sdkmanager "cmdline-tools;latest" "platforms;android-37.0" "build-tools;37.0.0" "ndk;30.0.16248370"
          echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/30.0.16248370" >> "$GITHUB_ENV"

      - name: Install Wails system dependencies
        if: matrix.language == 'java-kotlin'
        run: sudo apt-get update && sudo apt-get install -y libwebkitgtk-6.0-dev libgtk-4-dev libpango1.0-dev libharfbuzz-dev libgdk-pixbuf-2.0-dev libcairo2-dev libvulkan-dev libgraphene-1.0-dev libsoup-3.0-dev libglib2.0-dev libjavascriptcoregtk-6.0-dev

      - name: Install frontend, Wails, and gomobile dependencies
        if: matrix.language == 'java-kotlin'
        shell: bash
        run: |
          pnpm install --frozen-lockfile
          go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.20
          go install golang.org/x/mobile/cmd/gomobile@v0.0.0-20260821190718-4776eadac327
          gomobile init
      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          # 排除 node_modules 等第三方源码，见配置文件内的说明。
          config-file: ./.github/codeql/codeql-config.yml

      # Android's Gradle project lives under mobile/android and needs the generated AAR.
      - name: Build Android project for CodeQL
        if: matrix.build-mode == 'manual'
        shell: bash
        run: bash scripts/build/build-android-mobile.sh

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{matrix.language}}"