Repository navigation
CodeQL: own workflow that builds the phone app before scanning its Java - #41
Merged
Merged
Conversation
CodeQL's default setup scanned the Android app's Java with build-mode none, and Gradle could not resolve its dependencies: Capacitor's files (cordova.variables.gradle, node_modules/@capacitor/android) only exist after `cap sync`. The scan "encountered issues": 50 % of calls with a known target and 75 % of expressions with a known type, under the 85 % thresholds. This workflow replaces the default setup. Actions and JavaScript/TypeScript are scanned as before (no build); Java is built manually – bun install, build:mobile, cap sync, gradlew assembleDebug, with JDK 21 and no keys – so the analysis sees Android and Capacitor. It runs on pull requests, on main and weekly; actions are pinned like in CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CodeQL's status page flagged the Java/Kotlin scan: it "completed successfully, but the scan encountered issues" – only 50 % of calls had a known target and 75 % of expressions a known type (threshold 85 %). No security alerts are open; this is about scan quality.
Cause: the default setup scans
mobile/androidwith build-modenone, and Gradle can't resolve the app's dependencies there – Capacitor'scordova.variables.gradleandnode_modules/@capacitor/androidonly exist afterbun installandcap sync(the log showsCould not read script …/capacitor-cordova-android-plugins/cordova.variables.gradle).What changes
.github/workflows/codeql.yml(pull requests,main, weekly):actionsandjavascript-typescript: build-modenone, as before;java-kotlin: build-modemanual–bun install,build:mobile,cap sync android,gradlew assembleDebug(JDK 21, no keys), so the analysis sees Android and Capacitor.To switch over
A repository can't run CodeQL's default setup and an advanced workflow at the same time: until the default setup is turned off (Settings → Code security → CodeQL analysis → Switch to advanced, or the API), this workflow's upload step is rejected. Turn it off when merging this.
🤖 Generated with Claude Code