Project-Lumen/.github/workflows/codeql.yml at main · Chloemlla/Project-Lumen · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
name: CodeQL

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  schedule:
    - cron: "23 16 * * 2"
  workflow_dispatch:

permissions:
  contents: read
  packages: read

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 60

    permissions:
      actions: read
      contents: read
      packages: read
      security-events: write

    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: java-kotlin
            build-mode: manual
          - language: c-cpp
            build-mode: manual
          - language: actions
            build-mode: default

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Set up Java 21
        if: matrix.build-mode == 'manual'
        uses: actions/setup-java@v5
        with:
          distribution: zulu
          java-version: "21"

      - name: Accept Android SDK licenses
        if: matrix.build-mode == 'manual'
        run: |
          NDK_VERSION="$(sed -n 's/^projectLumenNdkVersion=//p' gradle.properties | tail -n 1 | tr -d '[:space:]')"
          CMAKE_VERSION="$(sed -n 's/^projectLumenCmakeVersion=//p' gradle.properties | tail -n 1 | tr -d '[:space:]')"
          if [ -z "$NDK_VERSION" ] || [ -z "$CMAKE_VERSION" ]; then
            echo "::error::projectLumenNdkVersion and projectLumenCmakeVersion must be set in gradle.properties."
            exit 1
          fi
          SDK_MANAGER="$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager"
          if [ ! -f "$SDK_MANAGER" ]; then
            SDK_MANAGER="$ANDROID_HOME/tools/bin/sdkmanager"
          fi
          if [ ! -f "$SDK_MANAGER" ]; then
            SDK_MANAGER="$(command -v sdkmanager || true)"
          fi
          if [ -z "$SDK_MANAGER" ]; then
            echo "::warning::sdkmanager was not found; the Android Gradle Plugin will download the toolchain itself."
            exit 0
          fi
          echo "Accepting Android SDK licenses via $SDK_MANAGER"
          yes | "$SDK_MANAGER" --licenses 2>&1 || true
          # AGP downloads these itself when missing, so a transient install failure must not fail the job.
          "$SDK_MANAGER" --install "ndk;${NDK_VERSION}" "cmake;${CMAKE_VERSION}" 2>&1 || true

      - name: Set up Gradle
        if: matrix.build-mode == 'manual'
        uses: gradle/actions/setup-gradle@v4
        with:
          gradle-version: "9.5.1"
          cache-read-only: ${{ github.event_name == 'pull_request' }}
          cache-cleanup: on-success

      - name: Initialize CodeQL for compiled code
        if: matrix.build-mode == 'manual'
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}

      - name: Initialize CodeQL
        if: matrix.build-mode == 'default'
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}

      - name: Build Android app for CodeQL
        if: matrix.build-mode == 'manual'
        run: gradle assembleDebug --no-daemon --warning-mode all

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"