codeql.yml

name: CodeQL

on:
  workflow_dispatch:
  schedule:
    - cron: '0 3 * * 1'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze (java-kotlin)
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      CODEQL_EXTRACTOR_KOTLIN_ALLOW_UNSUPPORTED_VERSION: true
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v6

      - name: Set up JDK 21
        uses: actions/setup-java@v5
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: 'gradle'

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: java-kotlin
          build-mode: manual

      # The extractor's Kotlin version gate runs in the compile process, so the allow-unsupported env must be job-wide and Kotlin must compile in-process rather than in its own daemon.
      - name: Build
        env:
          GRADLE_OPTS: -Dorg.gradle.jvmargs="-Xmx5g -XX:MaxMetaspaceSize=1g -Dfile.encoding=UTF-8"
        run: |
          echo "GEMINI_API_KEY=" >> local.properties
          chmod +x gradlew
          ./gradlew assembleDebug --no-daemon -Pkotlin.compiler.execution.strategy=in-process

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:java-kotlin