From 32555cce8acb964a6c0616b9f9a8280151f4a2db Mon Sep 17 00:00:00 2001
From: thefourCraft <me@thefourcraft.com>
Date: Sun, 28 Jun 2026 19:54:42 +0300
Subject: [PATCH] =?UTF-8?q?ci(codeql):=20sync=20baseline=20=E2=80=94=20rea?=
 =?UTF-8?q?l=20Android=20Kotlin=20scan=20+=20large-repo=20detect=20fix?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add analyze-android job (JDK 17 + committed gradlew, build-mode:manual,
  compileDebugSources) so Kotlin is actually analyzed; drop java-kotlin from
  the build-mode:none matrix (it can't read Kotlin).
- Fix language detection to read from a temp file (piped grep -q + pipefail
  SIGPIPE'd on large repos, skipping swift/android).
Proven green end-to-end on jomalabs/platform (Swift + Kotlin + JS/TS + Python + Actions).
---
 .github/workflows/codeql.yml | 67 ++++++++++++++++++++++++++++++++++--
 1 file changed, 64 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 853423e..1b9fb22 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -50,6 +50,7 @@ jobs:
     outputs:
       source_langs: ${{ steps.detect.outputs.source_langs }}
       has_swift: ${{ steps.detect.outputs.has_swift }}
+      has_android: ${{ steps.detect.outputs.has_android }}
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -59,13 +60,16 @@ jobs:
         run: |
           set -euo pipefail
           # List tracked paths once; classify by extension/marker. No eval/globbing.
-          files="$(git ls-files)"
-          has() { printf '%s\n' "$files" | grep -qiE "$1"; }
+          # Use a here-string (not a pipe): grep -q exits on first match, which on
+          # a large file list would SIGPIPE a piped producer and trip pipefail.
+          git ls-files > /tmp/cq_files.txt
+          has() { grep -qiE "$1" /tmp/cq_files.txt; }
 
+          # build-mode:none languages (no compile). java-kotlin is NOT here:
+          # build-mode:none can't analyze Kotlin — Android is built in its own job.
           langs='"actions"' # every repo has workflow files
           has '\.(ts|tsx|js|jsx|mjs|cjs)$'      && langs="$langs,\"javascript-typescript\""
           has '\.py$'                           && langs="$langs,\"python\""
-          has '\.(kt|kts|java)$'                && langs="$langs,\"java-kotlin\""
           echo "source_langs=[$langs]" >> "$GITHUB_OUTPUT"
 
           if has '\.swift$|\.xcodeproj(/|$)|\.xcworkspace(/|$)|(^|/)project\.yml$|(^|/)Package\.swift$'; then
@@ -74,6 +78,13 @@ jobs:
             echo "has_swift=false" >> "$GITHUB_OUTPUT"
           fi
 
+          # Android: a Gradle project with Kotlin/Java sources (needs a real build).
+          if has '(^|/)settings\.gradle(\.kts)?$|(^|/)build\.gradle(\.kts)?$' && has '\.(kt|kts|java)$'; then
+            echo "has_android=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_android=false" >> "$GITHUB_OUTPUT"
+          fi
+
   # ---------------------------------------------------------------------------
   # Source-only languages (build-mode:none) — one ubuntu runner.
   # ---------------------------------------------------------------------------
@@ -164,3 +175,53 @@ jobs:
         uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:swift"
+
+  # ---------------------------------------------------------------------------
+  # Android (Kotlin/Java) — build-mode:none can't read Kotlin, so we compile it.
+  # Self-detects the Gradle project (the committed wrapper) and compiles debug
+  # Kotlin under the CodeQL tracer. Debug needs no signing secrets.
+  # ---------------------------------------------------------------------------
+  analyze-android:
+    name: Analyze (java-kotlin)
+    needs: detect
+    if: needs.detect.outputs.has_android == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - name: Locate Gradle project
+        id: gr
+        run: |
+          set -euo pipefail
+          GW=$(find . -name gradlew -not -path '*/.git/*' | head -1)
+          [ -n "$GW" ] || { echo "::error::Android detected but no committed gradlew found." ; exit 1; }
+          echo "dir=$(dirname "$GW")" >> "$GITHUB_OUTPUT"
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        with:
+          languages: java-kotlin
+          build-mode: manual
+
+      - name: Compile Kotlin (CodeQL traces this)
+        working-directory: ${{ steps.gr.outputs.dir }}
+        run: |
+          set -euo pipefail
+          chmod +x ./gradlew
+          ./gradlew --no-daemon --stacktrace compileDebugSources
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        with:
+          category: "/language:java-kotlin"