feat(android): diagnose foregroundServiceType manifest mismatches (#82) #124

	name: CodeQL

	on:
	push:
	branches: [ main ]
	pull_request:
	branches: [ main ]
	schedule:
	# Weekly scan even if no commits land — catches new advisories that
	# affect existing code (e.g. a transitive dep CVE published after merge).
	- cron: '23 4 * * 1'
	workflow_dispatch:

	concurrency:
	group: codeql-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	analyze:
	name: Analyze (${{ matrix.language }})
	runs-on: macos-latest
	permissions:
	actions: read
	contents: read
	security-events: write

	strategy:
	fail-fast: false
	matrix:
	# `java-kotlin` covers all Kotlin sources (commonMain + androidMain).
	# iosMain is K/N — CodeQL has no native analyzer for K/N today, so it
	# is intentionally not in the matrix. When CodeQL ships K/N support,
	# add it here.
	language: [ 'java-kotlin' ]

	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-java@v4
	with:
	java-version: '17'
	distribution: 'temurin'
	- uses: gradle/actions/setup-gradle@v4
	- run: chmod +x gradlew

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: ${{ matrix.language }}
	queries: security-and-quality

	# Manual build — Gradle KMP projects do not autobuild reliably under CodeQL.
	- name: Build for CodeQL
	run: ./gradlew :kmpworker:compileDebugKotlinAndroid :kmpworker-ksp:compileKotlin

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v3
	with:
	category: "/language:${{ matrix.language }}"

Navigation Menu