android-codeql.yml

name: Android — CodeQL

# Uses an explicit Gradle build rather than CodeQL autobuild so we can
# set working-directory and write local.properties before the compile step.

on:
  push:
    branches: [main]
    paths:
      - "android/**"
  pull_request:
    branches: [main]
    paths:
      - "android/**"
  schedule:
    # Weekly scan — Tuesday 19:37 UTC
    - cron: "37 19 * * 2"

permissions:
  security-events: write
  actions: read
  contents: read

defaults:
  run:
    working-directory: android

jobs:
  analyze:
    name: Analyze (java-kotlin)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: java-kotlin
          queries: security-extended

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: temurin

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3
        with:
          cache-read-only: false

      - name: Write local.properties
        run: echo "sdk.dir=$ANDROID_SDK_ROOT" > local.properties

      - name: Build
        run: ./gradlew :app:assembleDebug --no-daemon

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:java-kotlin