codeql.yml

name: "CodeQL"

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
    types: [ opened, synchronize, reopened, ready_for_review ]
  schedule:
    - cron: '0 6 * * 1' # Weekly Monday 06:00 UTC

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  analyze:
    name: Analyze (Java/Kotlin)
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
      actions: read
    env:
      OER_APP_ID_RELEASE: ${{ secrets.OER_APP_ID_RELEASE }}
      # Disable parallel and daemon to ensure CodeQL intercepts compiler correctly
      GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx6g -Dorg.gradle.parallel=false -Dorg.gradle.daemon=false"
    steps:
      - uses: actions/checkout@v6

      - name: Set up JDK 21
        uses: actions/setup-java@v5
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Decode google-services.json
        run: |
          if [ -n "$GOOGLE_SERVICES_JSON_BASE64" ]; then
            echo "$GOOGLE_SERVICES_JSON_BASE64" | base64 --decode > app/google-services.json
          else
            echo '{"project_info":{"project_number":"0","project_id":"placeholder","storage_bucket":"placeholder.appspot.com"},"client":[{"client_info":{"mobilesdk_app_id":"1:0:android:0","android_client_info":{"package_name":"es.pedrazamiguez.splittrip"}},"api_key":[{"current_key":"placeholder"}]}]}' > app/google-services.json
          fi
        env:
          GOOGLE_SERVICES_JSON_BASE64: ${{ secrets.GOOGLE_SERVICES_JSON_BASE64 }}

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v5
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: Grant execute permission for gradlew
        run: chmod +x ./gradlew

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: java-kotlin
          build-mode: manual

      - name: Build for CodeQL
        # We enforce no-build-cache and no-configuration-cache so that CodeQL can intercept a full build
        run: ./gradlew clean assembleDebug --no-build-cache --no-configuration-cache

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:java-kotlin"