1name: CodeQL Security Scan
2
3on:
4 push:
5 branches: [ main ]
6 pull_request:
7 branches: [ main ]
8 schedule:
9 # Weekly scan every Monday at 08:00 UTC
10 - cron: '0 8 * * 1'
11
12jobs:
13 analyze:
14 name: Analyze (${{ matrix.language }})
15 runs-on: ${{ matrix.runner }}
16 permissions:
17 security-events: write
18 actions: read
19 contents: read
20
21 strategy:
22 fail-fast: false
23 matrix:
24 include:
25 - language: swift
26 runner: macos-15
27 - language: java-kotlin
28 runner: ubuntu-latest
29
30 steps:
31 - name: Checkout
32 uses: actions/checkout@v4
33
34 # Swift: select Xcode before CodeQL init so the build toolchain is found
35 - name: Select Xcode (Swift only)
36 if: matrix.language == 'swift'
37 run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
38
39 - name: Set up JDK 17 (Java/Kotlin only)
40 if: matrix.language == 'java-kotlin'
41 uses: actions/setup-java@v4
42 with:
43 java-version: '17'
44 distribution: 'temurin'
45 cache: gradle
46
47 - name: Initialize CodeQL
48 uses: github/codeql-action/init@v4
49 with:
50 languages: ${{ matrix.language }}
51 queries: security-and-quality
52
53 - name: Build SophaxChatCore (Swift)
54 if: matrix.language == 'swift'
55 run: swift build
56
57 - name: Generate Gradle wrapper (Java/Kotlin)
58 if: matrix.language == 'java-kotlin'
59 working-directory: android
60 run: |
61 if [ ! -f gradlew ]; then gradle wrapper --gradle-version=8.9; fi
62 chmod +x gradlew
63
64 - name: Build Android debug APK (Java/Kotlin)
65 if: matrix.language == 'java-kotlin'
66 working-directory: android
67 run: ./gradlew assembleDebug --no-daemon
68
69 - name: Perform CodeQL Analysis
70 uses: github/codeql-action/analyze@v4
71 with:
72 category: /language:${{ matrix.language }}