Restore CodeQL configuration workflow

[pedrazamiguez]

Problem / Motivation

• The CodeQL workflow (.github/workflows/codeql.yml) was previously removed in PR [SPLTRP-1246]: Upgrade Android SDK to 37 and update Version Catalog dependencies to latest stable versions #1260 due to Gradle plugin compatibility issues when upgrading the Android SDK to 37 and updating the Version Catalog (including Kotlin 2.4.10 and AGP 9.3.1).
• As a result, we no longer see code security and quality issues directly under the GitHub repository's security tab.
• This reduces our automated vulnerability detection capabilities on pull requests and pushes, relying solely on local static analysis and SonarQube.

Proposed Solution

• Restore .github/workflows/codeql.yml from the git history (prior to its deletion in commit 9ca9c240a).
• Update the workflow to use the latest github/codeql-action version (v3 or v4).
• Feasibility Study & Fixes:
  • CodeQL intercepts the Kotlin compiler. With Kotlin 2.4.10 and AGP 9.3.1, we must ensure that the CodeQL extractor is compatible.
  • Apply necessary Gradle flags (e.g., -Dorg.gradle.daemon=false, --no-build-cache, --no-configuration-cache) in the workflow to ensure the CodeQL tracer properly captures all compiled files.
  • If a specific plugin (like KSP or Compose compiler) causes the semantic extraction to fail, investigate workarounds such as building a specific target or skipping certain verification tasks during the CodeQL build step.

Acceptance Criteria

• .github/workflows/codeql.yml is restored and updated to use current action versions.
• CodeQL successfully builds and analyzes the project on CI without Gradle plugin conflicts.
• The GitHub Security tab populates CodeQL analysis results again.
• All existing tests pass; new tests added where behaviour changes.
• make fast-check passes during iterative development (~15–30s).
• make check > build.log 2>&1 && echo "Check passed successfully" || (tail -n 100 build.log && exit 1) passes with 0 failures before merging.
• No new detekt findings introduced.

Out of Scope

• Fixing any new or pre-existing security vulnerabilities reported by CodeQL once it runs successfully (this issue is purely for restoring the CI infrastructure).

Related Issues / PRs

• Removed in PR [SPLTRP-1246]: Upgrade Android SDK to 37 and update Version Catalog dependencies to latest stable versions #1260 (commit 9ca9c240a).

[github-actions]

🌱 Branch created

internal/SPLTRP-1517

This branch has been automatically created based on develop.

🚀 Getting started

Fetch and switch to this branch with the latest changes from develop:

git fetch origin
git checkout internal/SPLTRP-1517
git pull origin develop

📌 When creating your PR

• Base branch: develop
• Title:

  [SPLTRP-1517]: Restore CodeQL configuration workflow
  

• Description: Closes #1517

[pedrazamiguez]

Restore CodeQL configuration workflow

This plan details the restoration of the CodeQL workflow (.github/workflows/codeql.yml), which was previously removed in PR #1260 due to Gradle plugin compatibility issues. Restoring this workflow will re-enable automated vulnerability detection in the repository's security tab.

User Review Required

Important

Since this is a CI infrastructure change, please review the proposed codeql.yml file content to ensure the build commands and environment variables match your current CI requirements.

Proposed Changes

CI Workflows

[NEW] .github/workflows/codeql.yml

Create a new GitHub Actions workflow file to restore CodeQL analysis:

• Triggered on push/pull requests for main and develop, and a weekly schedule.
• Uses github/codeql-action/init@v4 and github/codeql-action/analyze@v4.
• Uses actions/checkout@v6, actions/setup-java@v5, and gradle/actions/setup-gradle@v5.
• Sets GRADLE_OPTS to disable the Gradle daemon (-Dorg.gradle.daemon=false) and parallel execution to ensure CodeQL's semantic extractor captures all compilation tasks.
• Runs ./gradlew clean assembleDebug --no-build-cache --no-configuration-cache manually for CodeQL.
• Decodes a placeholder or real google-services.json to allow the build to succeed.

name: "CodeQL"

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
    types: [ opened, synchronize, reopened, ready_for_review ]
  schedule:
    - cron: '0 6 * * 1' # Weekly Monday 06:00 UTC

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  analyze:
    name: Analyze (Java/Kotlin)
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
      actions: read
    env:
      OER_APP_ID_RELEASE: ${{ secrets.OER_APP_ID_RELEASE }}
      # Disable parallel and daemon to ensure CodeQL intercepts compiler correctly
      GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx6g -Dorg.gradle.parallel=false -Dorg.gradle.daemon=false"
    steps:
      - uses: actions/checkout@v6

      - name: Set up JDK 21
        uses: actions/setup-java@v5
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Decode google-services.json
        run: |
          if [ -n "$GOOGLE_SERVICES_JSON_BASE64" ]; then
            echo "$GOOGLE_SERVICES_JSON_BASE64" | base64 --decode > app/google-services.json
          else
            echo '{"project_info":{"project_number":"0","project_id":"placeholder","storage_bucket":"placeholder.appspot.com"},"client":[{"client_info":{"mobilesdk_app_id":"1:0:android:0","android_client_info":{"package_name":"es.pedrazamiguez.splittrip"}},"api_key":[{"current_key":"placeholder"}]}]}' > app/google-services.json
          fi
        env:
          GOOGLE_SERVICES_JSON_BASE64: ${{ secrets.GOOGLE_SERVICES_JSON_BASE64 }}

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v5
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: Grant execute permission for gradlew
        run: chmod +x ./gradlew

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: java-kotlin
          build-mode: manual

      - name: Build for CodeQL
        # We enforce no-build-cache and no-configuration-cache so that CodeQL can intercept a full build
        run: ./gradlew clean assembleDebug --no-build-cache --no-configuration-cache

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:java-kotlin"

Verification Plan

Automated Tests

• N/A, this is a CI pipeline configuration.

Manual Verification

• We will monitor the CI pipeline of the PR containing this change.
• Verify that the CodeQL workflow executes successfully without Gradle plugin conflicts.
• Verify that the GitHub Security tab populates CodeQL analysis results after merge.

[pedrazamiguez]

Implementation Walkthrough

Summary of Changes

• Created .github/workflows/codeql.yml to restore the CodeQL CI pipeline exactly as specified in the implementation plan.
• Configured the workflow to run on push and pull_request to main and develop branches, as well as a weekly schedule.
• Set up JDK 21 and Gradle (with actions/setup-java@v5 and gradle/actions/setup-gradle@v5).
• Passed GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx6g -Dorg.gradle.parallel=false -Dorg.gradle.daemon=false" to disable parallel execution and daemon, ensuring CodeQL intercepts the compiler properly.
• Added a manual CodeQL build step running ./gradlew clean assembleDebug --no-build-cache --no-configuration-cache.
• Included the step to decode the google-services.json so the build succeeds.

Testing and Validation Results

• ✅ make fast-check passed locally in ~15-30s.
• ✅ make check passed successfully with 0 failures, ensuring no detekt, ktlint, or Konsist findings were introduced.
• ✅ The branch internal/SPLTRP-1517 is ready for review and merges.