fdroid: bump com.filestech.sms to 1.3.6 (versionCode 36, commit af32bf7) #17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # v1.3.2 — analyse statique SAST hebdomadaire + sur chaque push main / PR. | |
| # Couvre la sécurité du code Kotlin/Java de l'app (CWE-89 injection, CWE-22 | |
| # path traversal, CWE-78 command injection, CWE-79 XSS, etc.). Les alertes | |
| # remontent dans l'onglet "Security" du repo (Code scanning). | |
| # | |
| # Pas de coût en repo public. | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| schedule: | |
| # Lundi 06:00 UTC — analyse régulière même sans commit récent (capture les | |
| # nouvelles règles CodeQL publiées par GitHub). | |
| - cron: '0 6 * * 1' | |
| jobs: | |
| analyze: | |
| name: Analyze (Kotlin / Java) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| permissions: | |
| # Required pour upload des résultats CodeQL. | |
| security-events: write | |
| # Required pour cloner le repo. | |
| contents: read | |
| # Required en cas de PR analysée. | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'java-kotlin' ] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '17' | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # Pack additionnel "security-extended" : règles CWE moins fréquentes | |
| # mais pertinentes pour une app SMS (parsing PDU, chiffrement, etc.). | |
| queries: security-extended,security-and-quality | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@v4 | |
| - name: Build with Gradle (debug variant, no signing required) | |
| # `assembleDebug` est suffisant pour que CodeQL voie tout le bytecode | |
| # de l'app (mêmes classes que release sans la minification R8 qui | |
| # masquerait les noms de symboles dans les alertes). | |
| run: ./gradlew :app:assembleDebug --no-daemon | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" |