codeql.yml

name: CodeQL

on:
  push:
    branches: [main]
    paths:
      - '.github/workflows/**'
      - 'apps/**'
      - 'packages/**'
      - 'scripts/**'
  pull_request:
    branches: [main]
    paths:
      - '.github/workflows/**'
      - 'apps/**'
      - 'packages/**'
      - 'scripts/**'
  workflow_dispatch:
  schedule:
    - cron: '23 7 * * 2'

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze (${{ matrix.language }}${{ matrix.platform && format(' / {0}', matrix.platform) || '' }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    permissions:
      contents: read
      security-events: write
      packages: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: actions
            os: ubuntu-latest
            build-mode: none
          - language: javascript-typescript
            os: ubuntu-latest
            build-mode: none
          - language: c-cpp
            os: ubuntu-latest
            build-mode: none
          - language: java-kotlin
            os: ubuntu-latest
            build-mode: manual
          - language: swift
            platform: ios
            os: macos-15
            build-mode: manual
          - language: swift
            platform: macos
            os: macos-15
            build-mode: manual
    steps:
      - uses: actions/checkout@v4
      - name: Select result destination
        id: results
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          upload=always
          if [ "$GITHUB_EVENT_NAME" = pull_request ]; then
            git fetch --no-tags --depth=1 origin "$BASE_SHA"
            if [ -z "$(git ls-tree --name-only "$BASE_SHA" -- .github/workflows/codeql.yml)" ]; then
              # The introducing PR must coexist with GitHub's default setup.
              # Subsequent PRs and all main/scheduled runs upload normally.
              upload=never
              echo 'Initial workflow validation: analysis results are saved as artifacts. After merge, switch from default to advanced CodeQL setup.' >> "$GITHUB_STEP_SUMMARY"
            fi
          fi
          echo "upload=$upload" >> "$GITHUB_OUTPUT"
      - name: Set up Java
        if: matrix.language == 'java-kotlin'
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
      - name: Set up Flutter
        if: matrix.build-mode == 'manual'
        uses: subosito/flutter-action@v2
        with:
          channel: stable
          # iOS already uses FlutterImplicitEngineDelegate (UIScene lifecycle).
          # Keep the existing SDK for Android/macOS; match the migrated iOS code.
          flutter-version: ${{ matrix.platform == 'ios' && '3.41.0' || '3.35.4' }}
      - name: Install Dashboard dependencies
        if: matrix.build-mode == 'manual'
        working-directory: apps/dashboard
        run: flutter pub get
      # CocoaPods dependencies must be installed before CodeQL starts tracing.
      # Config-only generates Flutter's Xcode settings without compiling Swift.
      - name: Prepare iOS project
        if: matrix.platform == 'ios'
        working-directory: apps/dashboard
        run: |
          flutter build ios --config-only --no-codesign --debug
          (cd ios && pod install)
      - name: Prepare macOS project
        if: matrix.platform == 'macos'
        working-directory: apps/dashboard
        run: |
          flutter build macos --config-only --debug
          (cd macos && pod install)
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
      - name: Build Android for Kotlin analysis
        if: matrix.language == 'java-kotlin'
        working-directory: apps/dashboard
        run: |
          # Keep both Gradle and Kotlin inside CodeQL's traced process tree.
          cat >> android/gradle.properties <<'PROPERTIES'

          org.gradle.jvmargs=-Xmx4G -XX:MaxMetaspaceSize=1G -XX:+HeapDumpOnOutOfMemoryError
          org.gradle.workers.max=2
          org.gradle.daemon=false
          kotlin.compiler.execution.strategy=in-process
          PROPERTIES
          flutter build apk --debug --target-platform android-arm64
      - name: Build iOS for Swift analysis
        if: matrix.platform == 'ios'
        timeout-minutes: 30
        working-directory: apps/dashboard
        run: |
          xcodebuild -workspace ios/Runner.xcworkspace -scheme Runner -configuration Debug -sdk iphonesimulator -destination 'generic/platform=iOS Simulator' ARCHS=arm64 ONLY_ACTIVE_ARCH=YES CODE_SIGNING_ALLOWED=NO COMPILER_INDEX_STORE_ENABLE=NO -jobs 2 build
      - name: Build macOS for Swift analysis
        if: matrix.platform == 'macos'
        timeout-minutes: 30
        working-directory: apps/dashboard
        run: |
          xcodebuild -workspace macos/Runner.xcworkspace -scheme Runner -configuration Debug ARCHS=arm64 ONLY_ACTIVE_ARCH=YES CODE_SIGNING_ALLOWED=NO COMPILER_INDEX_STORE_ENABLE=NO -jobs 2 build
      - name: Analyze
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:${{ matrix.language }}${{ matrix.platform && format('/platform:{0}', matrix.platform) || '' }}
          upload: ${{ steps.results.outputs.upload }}
          output: ${{ runner.temp }}/codeql-results
      - name: Save initial scan results
        if: steps.results.outputs.upload == 'never'
        uses: actions/upload-artifact@v4
        with:
          name: codeql-${{ matrix.language }}${{ matrix.platform && format('-{0}', matrix.platform) || '' }}
          path: ${{ runner.temp }}/codeql-results/*.sarif
          if-no-files-found: error
          retention-days: 7