deps(deps): bump the kotlin-and-compose group across 1 directory with 9 updates #97
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # v1.3.2 — analyse statique SAST hebdomadaire + sur chaque push main / PR. | |
| # Couvre la sécurité du code Kotlin/Java de l'app (CWE-89 injection, CWE-22 | |
| # path traversal, CWE-78 command injection, CWE-79 XSS, etc.). Les alertes | |
| # remontent dans l'onglet "Security" du repo (Code scanning). | |
| # | |
| # Pas de coût en repo public. | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| schedule: | |
| # Lundi 06:00 UTC — analyse régulière même sans commit récent (capture les | |
| # nouvelles règles CodeQL publiées par GitHub). | |
| - cron: '0 6 * * 1' | |
| jobs: | |
| analyze: | |
| name: Analyze (Kotlin / Java) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| permissions: | |
| # Required pour upload des résultats CodeQL. | |
| security-events: write | |
| # Required pour cloner le repo. | |
| contents: read | |
| # Required en cas de PR analysée. | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'java-kotlin' ] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '17' | |
| - name: Initialize CodeQL | |
| # v1.8.1 — `build-mode: none` (extraction source pure). CodeQL v4 pour | |
| # Kotlin a abandonné l'instrumentation Gradle automatique : le build | |
| # réussit mais l'extracteur ne voit aucun bytecode Kotlin | |
| # ("CodeQL detected code written in Java/Kotlin but could not process | |
| # any of it"). Le mode `none` scanne directement les `.kt` / `.java` | |
| # source — plus rapide (~3× moins long, pas de build), et c'est la | |
| # recommandation officielle pour Kotlin natif (GitHub docs Code Scanning | |
| # for compiled languages, v4 Kotlin extractor notes). | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: none | |
| # Pack additionnel "security-extended" : règles CWE moins fréquentes | |
| # mais pertinentes pour une app SMS (parsing PDU, chiffrement, etc.). | |
| queries: security-extended,security-and-quality | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{ matrix.language }}" |