GhostClass/.github/workflows/codeql.yml at main · devakesu/GhostClass · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
name: "CodeQL Analysis"

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "0 6 * * 1" # Weekly on Mondays at 06:00 UTC
  workflow_dispatch:

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

permissions:
  contents: read

jobs:
  codeql-js:
    name: CodeQL JavaScript/TypeScript
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Initialize CodeQL (JS/TS)
        uses: github/codeql-action/init@e58424170fb0262c8d7ed60a2e84b9bffe205c67
        with:
          languages: javascript-typescript

      - name: Autobuild (JS/TS)
        uses: github/codeql-action/autobuild@e58424170fb0262c8d7ed60a2e84b9bffe205c67

      - name: Run CodeQL analysis (JS/TS)
        uses: github/codeql-action/analyze@e58424170fb0262c8d7ed60a2e84b9bffe205c67
        with:
          category: "/language:javascript-typescript"

  codeql-actions:
    name: CodeQL Actions
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Initialize CodeQL (Actions)
        uses: github/codeql-action/init@e58424170fb0262c8d7ed60a2e84b9bffe205c67
        with:
          languages: actions

      - name: Autobuild (Actions)
        uses: github/codeql-action/autobuild@e58424170fb0262c8d7ed60a2e84b9bffe205c67

      - name: Run CodeQL analysis (Actions)
        uses: github/codeql-action/analyze@e58424170fb0262c8d7ed60a2e84b9bffe205c67
        with:
          category: "/language:actions"

  codeql-android:
    name: CodeQL Android (Java/Kotlin)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Download Gradle Wrapper
        run: |
          mkdir -p mobile/android/gradle/wrapper
          curl -fSL -o mobile/android/gradle/wrapper/gradle-wrapper.jar https://raw.githubusercontent.com/gradle/gradle/v9.6.1/gradle/wrapper/gradle-wrapper.jar
          echo "497c8c2a7e5031f6aa847f88104aa80a93532ec32ee17bdb8d1d2f67a194a9c7  mobile/android/gradle/wrapper/gradle-wrapper.jar" | sha256sum -c -

      - name: Set up JDK
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961
        with:
          distribution: "temurin"
          java-version: "25"
          cache: "gradle"
          cache-dependency-path: "mobile/android/gradle/wrapper/gradle-wrapper.properties"

      - name: Set up Flutter
        uses: ./.github/actions/flutter-action
        with:
          channel: stable
          cache: true

      - name: Fetch Flutter dependencies
        working-directory: mobile
        run: flutter pub get

      - name: Prepare app_secrets.dart
        working-directory: mobile
        run: cp lib/config/app_secrets.dart.example lib/config/app_secrets.dart

      - name: Prepare google-services.json
        working-directory: mobile
        env:
          GOOGLE_SERVICES_JSON_BASE64: ${{ env.GOOGLE_SERVICES_JSON_BASE64 || secrets.GOOGLE_SERVICES_JSON_BASE64 }}
        run: |
          set -euo pipefail
          set +x
          if [ -n "${GOOGLE_SERVICES_JSON_BASE64:-}" ]; then
            echo "::add-mask::$GOOGLE_SERVICES_JSON_BASE64"
            printf '%s' "$GOOGLE_SERVICES_JSON_BASE64" | base64 --decode > android/app/google-services.json
            echo "✓ Recreated android/app/google-services.json from secret"
          elif [ -f android/app/google-services.json ]; then
            echo "✓ Using checked-in android/app/google-services.json"
          else
            node -e '
              const fs = require("fs");
              const stub = {
                project_info: { project_number: "424804867878", project_id: "devakesu-ghostclass", storage_bucket: "devakesu-ghostclass.appspot.com" },
                client: [
                  { client_info: { mobilesdk_app_id: "1:424804867878:android:df401041d564c22b21abe7", android_client_info: { package_name: "com.devakesu.apps.ghostclass" } }, oauth_client: [], api_key: [{ current_key: "AIzaSyDUMMY" }], services: { appinvite_service: { other_platform_oauth_client: [] } } }
                ],
                configuration_version: "1"
              };
              fs.writeFileSync("android/app/google-services.json", JSON.stringify(stub, null, 2));
            '
            echo "✓ Created CI stub android/app/google-services.json"
          fi

      - name: Initialize CodeQL (Java + Kotlin)
        uses: github/codeql-action/init@e58424170fb0262c8d7ed60a2e84b9bffe205c67
        with:
          languages: java-kotlin
          build-mode: manual

      - name: Build Android Kotlin source (Triggers CodeQL extraction)
        working-directory: mobile/android
        run: ./gradlew :app:compileDebugSources --no-daemon

      - name: Run CodeQL analysis (Android)
        uses: github/codeql-action/analyze@e58424170fb0262c8d7ed60a2e84b9bffe205c67
        with:
          category: "/language:java-kotlin"