codeql.yml

name: CodeQL

on:
  # Paused on push/PR/schedule: CodeQL's Kotlin extractor (CLI 2.25.6) hits an
  # internal compiler error on Kotlin 2.4.x, which this project requires for JVM
  # 25 bytecode (2.3 is the floor; downgrading is not an option). Re-enable the
  # push / pull_request / schedule triggers once CodeQL ships Kotlin 2.4 support.
  workflow_dispatch:

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze (Kotlin)
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      # Actions are pinned to a full commit SHA (supply-chain hardening); the
      # trailing comment records the human-readable version. Dependabot bumps the
      # SHA and updates the comment on its weekly run.
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Set up JDK 25
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: '25'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0

      # CodeQL's Kotlin extractor caps the Kotlin versions it will analyse and
      # lags new Kotlin releases by weeks: a Kotlin even one patch newer than the
      # bundled extractor supports is rejected ("Kotlin version X is too recent.
      # CodeQL currently supports versions below Y"), and the run fails. The cap is
      # an *exclusive* upper bound — the extractor rejects any version >= the limit
      # — so the limit must be strictly greater than the version we build with.
      # Read the real version from the catalog and bump its patch component (2.4.0
      # -> 2.4.1) so our exact version sits just below the cap. A patch bump keeps
      # the Kotlin compiler-plugin API compatible, so extraction still works. If a
      # future Kotlin *minor* breaks extraction outright, drop the workflow until
      # CodeQL ships support, or pin Kotlin to a supported release for CI.
      - name: Raise CodeQL Kotlin version cap above the project's Kotlin
        run: |
          kv=$(grep -E '^kotlin[[:space:]]*=' gradle/libs.versions.toml | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
          if [ -z "$kv" ]; then
            echo "Could not read the Kotlin version from gradle/libs.versions.toml" >&2
            exit 1
          fi
          # The cap is exclusive, so set it one patch above the version in use.
          limit=$(echo "$kv" | awk -F. -v OFS=. '{ $3 = $3 + 1; print }')
          echo "Project Kotlin version: $kv (cap set to $limit)"
          echo "CODEQL_EXTRACTOR_KOTLIN_OVERRIDE_MAXIMUM_VERSION_LIMIT=$limit" >> "$GITHUB_ENV"

      # GitHub CodeQL analyses Kotlin through its java-kotlin pack.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
        with:
          languages: java-kotlin
          queries: security-and-quality
          build-mode: manual

      # --no-build-cache forces the Kotlin compiler to actually run under CodeQL's
      # build tracer; a cache/UP-TO-DATE hit would skip kotlinc and again leave
      # CodeQL with "no source code seen".
      - name: Build
        run: ./gradlew assemble --no-build-cache --stacktrace

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
        with:
          category: "/language:java-kotlin"