Skip to content

ci: add CodeQL workflow for Kotlin/Java and Swift analysis - #1

Closed
kirillinoz wants to merge 6 commits into
mainfrom
kotlin-kmp-app-scaffold
Closed

kirillinoz wants to merge 6 commits into
mainfrom
kotlin-kmp-app-scaffold

Conversation

@kirillinoz

@kirillinoz kirillinoz commented Jun 28, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

  • Custom CodeQL workflow overriding org-level default (which fails with build-mode: none for compiled languages)
  • Matrix strategy: java-kotlin on ubuntu-latest, swift on macos-latest
  • Gradle assemble for KMP build; xcodebuild for iOS
  • Triggers: push/PR to main + weekly Monday cron

Test plan

  • Check Actions tab after merge — both matrix jobs run
  • CodeQL alerts page becomes active after first successful run

🤖 Generated with Claude Code

kirillinoz and others added 3 commits June 28, 2026 19:59
Custom workflow overrides org-level default which fails due to build-mode:none.
Matrix strategy builds Gradle (ubuntu) and Xcode (macos) before scanning.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- CodeQL action v3 → v4 (v3 deprecated Dec 2026)
- Add build-mode: manual to avoid overlay database fallback warning
- Cache Gradle dependencies for faster repeat builds

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
generic/platform=iOS Simulator resolved to x86_64 which KMP Compose
Multiplatform does not support. Explicit arm64 + named simulator fixes it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@github-advanced-security

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

kirillinoz and others added 3 commits June 28, 2026 20:21
iPhone 16 not available on Xcode 26.5 runners. Generic destination
with ARCHS=arm64 avoids hardcoding a specific simulator name.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Swift job runs Gradle via Xcode build phase (Kotlin/Native framework).
Removed java-kotlin condition so both jobs get Gradle + Konan cache.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Compose Multiplatform 1.11.1 uses UIViewLayoutRegion (iOS 26 API).
Runner defaulted to Xcode 16.4 which only has iOS 18.5 SDK, causing
linker failure. Explicitly select Xcode 26.x before building.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@kirillinoz kirillinoz closed this Jun 28, 2026
@kirillinoz
kirillinoz deleted the kotlin-kmp-app-scaffold branch June 28, 2026 19:04
@kirillinoz

Copy link
Copy Markdown
Collaborator Author

Just turn off the checks

@kirillinoz kirillinoz self-assigned this Aug 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants