codeql.yml

name: CodeQL

# Supersede an in-flight run when a newer commit lands on the same ref, so
# rapid pushes/PR updates don't stack redundant runs.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Static security analysis (SAST) for the Kotlin/Java source. Complements
# gitleaks (secret-scan.yml, catches committed credentials) and ktlint/detekt
# (ci.yml, style/quality) with vulnerability-pattern scanning — injection,
# insecure crypto, unsafe deserialization, etc. Results show up under the
# repo's Security > Code scanning tab.

# No push trigger: a full Kotlin compile per push was the repo's biggest
# Actions cost. PRs are still gated, and the weekly schedule scans main —
# push-to-main coverage is delayed by at most a week, not lost.
on:
  pull_request:
    branches: [ main ]
  schedule:
    # 04:15 UTC weekly — catches newly published query rules against unchanged code.
    - cron: '15 4 * * 1'
  workflow_dispatch:

permissions:
  contents: read
  security-events: write
  actions: read

jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      # Why manual build-mode (not `none`, not `autobuild`):
      #
      #  * `build-mode: none` extracts JAVA source only — the java-kotlin
      #    extractor SKIPS every .kt file without a build, and since this app is
      #    all Kotlin the database ends up empty and the run fails hard with
      #    "no source code seen" (gh.io/troubleshooting-code-scanning/
      #    kotlin-detected-in-no-build). Kotlin extraction REQUIRES a compile.
      #  * `autobuild` compiles fine but then runs a full `assemble`, which hits
      #    `:app:validateSigningDebug`. The debug build type is wired to the
      #    custom `stableDebug` signing config whose keystore
      #    (~/.android/inventory-debug.jks) is provisioned only by ci.yml /
      #    release.yml from a secret — absent here, so the build dies before
      #    analysis and the run is skipped.
      #
      # So we trace a compile-ONLY task. `:app:compileDebugKotlin` (with its KSP
      # predecessor) compiles main + generated Kotlin with full type resolution —
      # everything CodeQL needs — and never enters the packaging/signing phase,
      # exactly like ci.yml's ktlint/test jobs that also build without the keystore.
      - name: Validate Gradle wrapper
        uses: gradle/actions/wrapper-validation@v6

      - name: Set up JDK 17
        uses: actions/setup-java@v6.1.0
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4.39.1
        with:
          languages: java-kotlin
          build-mode: manual

      # CodeQL traces the compiler processes launched under this step to inject
      # its Kotlin extractor. Two things would otherwise leave it with nothing to
      # trace: (1) Kotlin's OWN compiler daemon runs the compile in a detached
      # process the tracer can't follow — force in-process so kotlinc runs inside
      # the traced Gradle JVM; (2) a warm Gradle cache (setup-gradle) could serve
      # compileDebugKotlin FROM-CACHE / UP-TO-DATE and never invoke kotlinc at all
      # — --rerun-tasks --no-build-cache guarantees a real compile happens here.
      - name: Compile Kotlin (no packaging, no signing)
        run: >-
          ./gradlew :app:compileDebugKotlin
          --no-daemon --no-build-cache --rerun-tasks --stacktrace
          -Dkotlin.compiler.execution.strategy=in-process

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4.39.1
        with:
          category: '/language:java-kotlin'