openclaw/.github/workflows/codeql.yml at main · DojoCodingLabs/openclaw · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
name: CodeQL

on:
  workflow_dispatch:

concurrency:
  group: codeql-${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

permissions:
  actions: read
  contents: read
  security-events: write

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ${{ matrix.runs_on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: javascript-typescript
            runs_on: blacksmith-16vcpu-ubuntu-2404
            needs_node: true
            needs_python: false
            needs_java: false
            needs_swift_tools: false
            needs_manual_build: false
            needs_autobuild: false
            config_file: ./.github/codeql/codeql-javascript-typescript.yml
          - language: actions
            runs_on: blacksmith-16vcpu-ubuntu-2404
            needs_node: false
            needs_python: false
            needs_java: false
            needs_swift_tools: false
            needs_manual_build: false
            needs_autobuild: false
            config_file: ""
          - language: python
            runs_on: blacksmith-16vcpu-ubuntu-2404
            needs_node: false
            needs_python: true
            needs_java: false
            needs_swift_tools: false
            needs_manual_build: false
            needs_autobuild: false
            config_file: ""
          - language: java-kotlin
            runs_on: blacksmith-16vcpu-ubuntu-2404
            needs_node: false
            needs_python: false
            needs_java: true
            needs_swift_tools: false
            needs_manual_build: true
            needs_autobuild: false
            config_file: ""
          - language: swift
            runs_on: macos-latest
            needs_node: false
            needs_python: false
            needs_java: false
            needs_swift_tools: true
            needs_manual_build: true
            needs_autobuild: false
            config_file: ""
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          submodules: false

      - name: Setup Node environment
        if: matrix.needs_node
        uses: ./.github/actions/setup-node-env
        with:
          install-bun: "false"
          use-sticky-disk: "false"

      - name: Setup Python
        if: matrix.needs_python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Setup Java
        if: matrix.needs_java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: "21"

      - name: Setup Swift build tools
        if: matrix.needs_swift_tools
        run: |
          sudo xcode-select -s /Applications/Xcode_26.1.app
          xcodebuild -version
          brew install xcodegen swiftlint swiftformat
          swift --version

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          queries: security-and-quality
          config-file: ${{ matrix.config_file || '' }}

      - name: Autobuild
        if: matrix.needs_autobuild
        uses: github/codeql-action/autobuild@v4

      - name: Build Android for CodeQL
        if: matrix.language == 'java-kotlin'
        working-directory: apps/android
        run: ./gradlew --no-daemon :app:assemblePlayDebug

      - name: Build Swift for CodeQL
        if: matrix.language == 'swift'
        run: |
          set -euo pipefail
          swift build --package-path apps/macos --configuration release
          cd apps/ios
          xcodegen generate
          xcodebuild build \
            -project OpenClaw.xcodeproj \
            -scheme OpenClaw \
            -destination "generic/platform=iOS Simulator" \
            CODE_SIGNING_ALLOWED=NO

      - name: Analyze
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"