name: Code quality analysis on: push: branches: - main - renovate/** schedule: - cron: '31 7 * * 3' workflow_dispatch: concurrency: group: ${{ github.workflow }}-${{ github.ref }} permissions: contents: read security-events: write jobs: codeql: name: CodeQL runs-on: ubuntu-latest steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Set up JDK uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0 with: distribution: temurin java-version: 18 - name: Setup Gradle caching uses: gradle/gradle-build-action@842c587ad8aa4c68eeba24c396e15af4c2e9f30a # v2.9.0 with: gradle-home-cache-cleanup: true cache-read-only: true - name: Initialize CodeQL uses: github/codeql-action/init@66b90a5db151a8042fa97405c6cf843bbe433f7b # v2.22.7 with: languages: java tools: latest queries: +security-extended - name: Build project shell: bash run: | ./gradlew assembleDebug assembleRelease - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@66b90a5db151a8042fa97405c6cf843bbe433f7b # v2.22.7 with: category: "/language:java" mobsfscan: name: MobSF runs-on: ubuntu-latest steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Set up JDK uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0 with: distribution: temurin java-version: 18 - name: Setup Gradle caching uses: gradle/gradle-build-action@842c587ad8aa4c68eeba24c396e15af4c2e9f30a # v2.9.0 with: gradle-home-cache-cleanup: true cache-read-only: true - name: Setup python uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4 with: python-version: 3.8 - name: Run mobsfscan uses: MobSF/mobsfscan@b8503e0027d134f55cc3306582efbbbeaa96c7ba with: args: . --sarif --output results.sarif || true - name: Upload mobsfscan report uses: github/codeql-action/upload-sarif@v2 with: sarif_file: results.sarif