PollingEngine/.github/workflows/codeql.yml at main · bosankus/PollingEngine · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
name: CodeQL

# On merge to main, CodeQL runs as jobs inside release.yml (the single release flow) so the whole
# pipeline shows as one graph. This workflow only covers pre-merge PRs and the weekly scheduled
# scan — it intentionally does NOT trigger on push to main to avoid a second workflow on merge.
on:
  pull_request:
    branches: [ main, master ]
  schedule:
    - cron: '0 3 * * 1'

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze-kotlin:
    name: Analyze (Java/Kotlin)
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    # CodeQL's Kotlin extractor only supports Kotlin < 2.3.30 and hard-fails on newer
    # compilers (KotlinVersionTooRecentError). This project is on 2.4.0, so bypass the
    # version gate; the extractor still runs (analysis may be incomplete for language
    # features added after the supported version). Remove once CodeQL supports 2.4.x.
    env:
      CODEQL_EXTRACTOR_KOTLIN_OVERRIDE_MAXIMUM_VERSION_CHECK: true
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '17'
          cache: 'gradle'
      - uses: github/codeql-action/init@v3
        with:
          languages: 'java-kotlin'
      # CodeQL's Kotlin extractor traces a real Kotlin/JVM compilation. The
      # `compileKotlinMetadata` task only emits a klib (no JVM bytecode), so
      # CodeQL reports "no source code seen" and fails. Compiling the Android
      # target produces JVM .class files and folds in commonMain, covering all
      # library source for analysis.
      #
      # The compile MUST actually execute under CodeQL's build tracer, otherwise
      # the finalize step fails with "no source code seen during build":
      #   --no-build-cache + --rerun-tasks  : gradle.properties sets
      #     org.gradle.caching=true and the gradle cache is restored above, so
      #     without these the task is served FROM-CACHE/UP-TO-DATE and the
      #     compiler never runs.
      #   -Pkotlin.compiler.execution.strategy=in-process : run the Kotlin
      #     compiler inside the traced Gradle JVM instead of a Kotlin daemon the
      #     tracer can't see.
      -   name: Build Kotlin (Android target, JVM bytecode)
          run: >-
            ./gradlew :pollingengine:compileAndroidMain
            --no-daemon --no-build-cache --rerun-tasks
            -Pkotlin.compiler.execution.strategy=in-process
            --stacktrace
      - uses: github/codeql-action/analyze@v3

  analyze-swift:
    name: Analyze (Swift)
    # Compose Multiplatform 1.11.x links against the iOS 26 SDK
    # (UIViewLayoutRegion / UIUtilities), so building the iosApp Xcode project
    # requires Xcode 26. On older images (e.g. macos-15 / Xcode 16.x) the link
    # step fails with "Undefined symbols ... _OBJC_CLASS_$_UIViewLayoutRegion".
    runs-on: macos-26
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v5
      -   name: Select Xcode 26
          uses: maxim-lobanov/setup-xcode@v1
          with:
            xcode-version: latest-stable
      - uses: github/codeql-action/init@v3
        with:
          languages: 'swift'
      # Custom build steps for Swift (explicit xcodebuild)
      - name: Build iOS app for simulator (no code signing)
        run: xcodebuild -project iosApp/iosApp.xcodeproj -scheme iosApp -sdk iphonesimulator -configuration Release CODE_SIGNING_ALLOWED=NO build
      - uses: github/codeql-action/analyze@v3