codeql.yml

name: "CodeQL Analysis"

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

permissions:
  contents: read

jobs:
  detect-changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      js: ${{ steps.filter.outputs.js }}
      android: ${{ steps.filter.outputs.android }}
      ios: ${{ steps.filter.outputs.ios }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - name: Detect path changes
        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
        id: filter
        with:
          filters: |
            js:
              - "src/**"
              - "public/**"
              - "supabase/**"
              - "package.json"
              - "package-lock.json"
              - "tsconfig.json"
              - "next.config.ts"
              - "eslint.config.mjs"
              - "components.json"
              - ".github/workflows/codeql.yml"
            android:
              - "mobile/android/**"
              - "mobile/lib/**"
              - "mobile/pubspec.yaml"
              - "mobile/pubspec.lock"
              - ".github/workflows/codeql.yml"
            ios:
              - "mobile/ios/**"
              - "mobile/lib/**"
              - "mobile/pubspec.yaml"
              - "mobile/pubspec.lock"
              - ".github/workflows/codeql.yml"

  codeql-js:
    name: CodeQL JavaScript/TypeScript
    needs: detect-changes
    if: github.event_name == 'push' || needs.detect-changes.outputs.js == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0

      - name: Initialize CodeQL (JS)
        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e
        with:
          languages: javascript

      - name: Autobuild (JS)
        uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e

      - name: Run CodeQL analysis (JS)
        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e
        with:
          category: javascript

  codeql-android:
    name: CodeQL Android (Java/Kotlin)
    needs: detect-changes
    if: github.event_name == 'push' || needs.detect-changes.outputs.android == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0

      - name: Download Gradle Wrapper
        run: |
          mkdir -p mobile/android/gradle/wrapper
          curl -fSL -o mobile/android/gradle/wrapper/gradle-wrapper.jar https://raw.githubusercontent.com/gradle/gradle/v8.14.0/gradle/wrapper/gradle-wrapper.jar
          echo "7d3a4ac4de1c32b59bc6a4eb8ecb8e612ccd0cf1ae1e99f66902da64df296172  mobile/android/gradle/wrapper/gradle-wrapper.jar" | sha256sum -c -

      - name: Set up JDK 17
        uses: actions/setup-java@b622de1dfa918ecc0ab28f40cd42e3c3752cd6c5
        with:
          distribution: "temurin"
          java-version: "17"
          cache: "gradle"

      - name: Set up Flutter
        uses: ./.github/actions/flutter-action
        with:
          channel: stable
          cache: true

      - name: Create CI app secrets stub
        working-directory: mobile
        run: cp lib/config/app_secrets.dart.example lib/config/app_secrets.dart

      - name: Create CI Firebase Android stub
        working-directory: mobile
        run: |
          cat > android/app/google-services.json <<'EOF'
          {
            "project_info": {
              "project_number": "424804867878",
              "project_id": "devakesu-ghostclass",
              "storage_bucket": "devakesu-ghostclass.appspot.com"
            },
            "client": [
              {
                "client_info": {
                  "mobilesdk_app_id": "1:424804867878:android:df401041d564c22b21abe7",
                  "android_client_info": {
                    "package_name": "com.devakesu.apps.ghostclass"
                  }
                },
                "oauth_client": [],
                "api_key": [
                  {
                    "current_key": "AIzaSyDUMMY"
                  }
                ],
                "services": {
                  "appinvite_service": {
                    "other_platform_oauth_client": []
                  }
                }
              }
            ],
            "configuration_version": "1"
          }
          EOF

      - name: Create CI Firebase iOS stub
        working-directory: mobile
        run: |
          cat > ios/Runner/GoogleService-Info.plist <<'EOF'
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
            <key>API_KEY</key>
            <string>AIzaSyDUMMY</string>
            <key>BUNDLE_ID</key>
            <string>com.devakesu.apps.ghostclass</string>
            <key>GCM_SENDER_ID</key>
            <string>424804867878</string>
            <key>GOOGLE_APP_ID</key>
            <string>1:424804867878:ios:d132bb8be987f52d21abe7</string>
            <key>IS_ADS_ENABLED</key>
            <false/>
            <key>IS_ANALYTICS_ENABLED</key>
            <false/>
            <key>IS_APPINVITE_ENABLED</key>
            <false/>
            <key>IS_GCM_ENABLED</key>
            <true/>
            <key>IS_SIGNIN_ENABLED</key>
            <false/>
            <key>PLIST_VERSION</key>
            <string>1</string>
            <key>PROJECT_ID</key>
            <string>devakesu-ghostclass</string>
            <key>STORAGE_BUCKET</key>
            <string>devakesu-ghostclass.appspot.com</string>
          </dict>
          </plist>
          EOF

      - name: Downgrade device_info_plus for compatibility
        working-directory: mobile
        run: |
          sed -i 's/device_info_plus: .*/device_info_plus: 12.2.0/g' pubspec.yaml

      - name: Fetch Flutter dependencies
        working-directory: mobile
        run: flutter pub get

      - name: Install Android SDK (basic)
        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699
        with:
          accept-android-sdk-licenses: true
          packages: 'platform-tools build-tools;33.0.2 platforms;android-33'

      - name: Initialize CodeQL (Java + Kotlin)
        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e
        with:
          languages: java-kotlin
          build-mode: manual

      - name: Build Android app (required for manual CodeQL extraction)
        working-directory: mobile/android
        run: |
          chmod +x ./gradlew
          ./gradlew assembleDebug --no-daemon -Pci

      - name: Run CodeQL analysis (Android)
        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e
        with:
          category: java,kotlin

  codeql-ios:
    name: CodeQL iOS (Swift)
    needs: detect-changes
    if: github.event_name == 'push' || needs.detect-changes.outputs.ios == 'true'
    runs-on: macos-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0

      - name: Set up Flutter
        uses: ./.github/actions/flutter-action
        with:
          channel: stable
          cache: true

      - name: Create CI app secrets stub
        working-directory: mobile
        run: cp lib/config/app_secrets.dart.example lib/config/app_secrets.dart

      - name: Downgrade device_info_plus for compatibility
        working-directory: mobile
        run: |
          sed -i '' 's/device_info_plus: .*/device_info_plus: 12.2.0/g' pubspec.yaml

      - name: Fetch Flutter dependencies
        working-directory: mobile
        run: flutter pub get

      - name: Cache CocoaPods
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
        with:
          path: mobile/ios/Pods
          key: ${{ runner.os }}-pods-${{ hashFiles('mobile/pubspec.lock', 'mobile/ios/Podfile') }}
          restore-keys: |
            ${{ runner.os }}-pods-

      - name: Configure iOS project for simulator build
        working-directory: mobile
        run: flutter build ios --simulator --no-codesign

      - name: Initialize CodeQL (Swift)
        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e
        with:
          languages: swift
          build-mode: manual

      - name: Build iOS app
        run: |
          set -o pipefail
          xcodebuild -workspace mobile/ios/Runner.xcworkspace \
            -scheme Runner \
            -configuration Debug \
            -sdk iphonesimulator \
            -destination 'generic/platform=iOS Simulator' \
            -derivedDataPath ~/Library/Developer/Xcode/DerivedData \
            CODE_SIGNING_REQUIRED=NO \
            CODE_SIGNING_ALLOWED=NO

      - name: Run CodeQL analysis (Swift)
        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e
        with:
          category: swift