RIA-DigiDoc-iOS/.github/workflows/codeql.yml at main · open-eid/RIA-DigiDoc-iOS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
# SPDX-FileCopyrightText: Estonian Information System Authority
# SPDX-License-Identifier: LGPL-2.1-or-later

name: CodeQL
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  schedule:
    - cron: "0 3 * * 1" # Weekly

jobs:
  swift:
    name: CodeQL (swift)
    if: contains(github.repository, 'open-eid/RIA-DigiDoc-iOS')
    runs-on: macos-26
    timeout-minutes: 120
    permissions:
      contents: read
      actions: read
      security-events: write
    concurrency:
      group: codeql-swift-${{ github.ref }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
    strategy:
      matrix:
        xcode:
          - 26.6
        platform:
          - iOS
    steps:
    - name: Checkout
      uses: actions/checkout@v7
      with:
        submodules: recursive
    - name: Set up build environment
      uses: ./.github/actions/setup-build-env
      with:
        xcode: ${{ matrix.xcode }}
        google-services-plist: ${{ secrets.GOOGLE_SERVICES_PLIST }}
    - name: Resolve package dependencies
      run: |
        cd ${{ github.workspace }}

        rm -rf ~/Library/Developer/Xcode/DerivedData/*
        rm -rf "${{ runner.temp }}/codeql-build"
        rm -rf ${{ github.workspace }}/.build

        xcodebuild -resolvePackageDependencies \
          -project RIADigiDoc.xcodeproj \
          -scheme RIADigiDoc \
          -derivedDataPath "${{ runner.temp }}/codeql-build"
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: swift
        build-mode: manual
    - name: Build
      run: |
        cd ${{ github.workspace }}

        xcodebuild build \
          -project RIADigiDoc.xcodeproj \
          -skipPackagePluginValidation \
          -scheme RIADigiDoc \
          -destination 'platform=iOS Simulator,name=iPhone 17' \
          -derivedDataPath "${{ runner.temp }}/codeql-build" \
          COMPILATION_CACHE_ENABLE_CACHING=NO \
          SWIFT_ENABLE_COMPILE_CACHE=NO \
          SWIFT_USE_INTEGRATED_DRIVER=NO \
          -quiet
    - name: Perform CodeQL analysis
      uses: github/codeql-action/analyze@v4
    - name: Clean up
      if: ${{ always() }}
      run: |
        rm -rf ~/Library/Developer/Xcode/DerivedData/*
        rm -rf "${{ runner.temp }}/codeql-build"
        rm -rf ${{ github.workspace }}/.build

  scripts:
    name: CodeQL (${{ matrix.language }})
    if: contains(github.repository, 'open-eid/RIA-DigiDoc-iOS')
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      actions: read
      security-events: write
    concurrency:
      group: codeql-${{ matrix.language }}-${{ github.ref }}
      cancel-in-progress: true
    strategy:
      fail-fast: false
      matrix:
        language:
          - actions
          - python
    steps:
    - name: Checkout
      uses: actions/checkout@v7
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: ${{ matrix.language }}
    - name: Perform CodeQL analysis
      uses: github/codeql-action/analyze@v4
      with:
        category: "/language:${{ matrix.language }}"