codeql.yml

name: CodeQL

# NOTE: CodeQL's Kotlin extractor currently supports only Kotlin < 2.3.30, but
# this project builds on Kotlin 2.4.0. Both extraction modes are dead ends today:
#   * build-mode: manual → the traced compile fails with
#       "KotlinVersionTooRecentError: supports versions below 2.3.30"
#   * build-mode: none   → "no source code seen during build" (can't read Kotlin)
# So CodeQL can't analyze this codebase yet. To avoid a red X on every push/PR
# while we wait for the extractor to catch up, this workflow only runs on a
# weekly schedule and on manual dispatch. The manual build-mode is kept so the
# job starts working again automatically once CodeQL supports Kotlin 2.4.
on:
  schedule:
    - cron: '0 6 * * 1'
  workflow_dispatch:

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze (java-kotlin)
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: zulu
          java-version: 17

      - uses: gradle/actions/setup-gradle@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: java-kotlin
          build-mode: manual

      # --rerun-tasks --no-build-cache force kotlinc to actually run under the
      # tracer; otherwise setup-gradle's restored cache makes compileKotlinJvm
      # UP-TO-DATE, CodeQL sees no compilation, and the analysis fails with
      # "no source code seen during build".
      - name: Compile JVM sources (traced by CodeQL)
        run: ./gradlew compileKotlinJvm --no-daemon --no-build-cache --rerun-tasks

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:java-kotlin"