From eeda087e5e12a53da1e36ce2a966ff13e60cc1cb Mon Sep 17 00:00:00 2001
From: Guyiome <guyiome.b@gmail.com>
Date: Thu, 20 Aug 2026 18:28:21 +0200
Subject: [PATCH 1/2] Add CodeQL static analysis workflow (java-kotlin)

Repo is public and the app handles inbound network protocols (passive
UDP listener for VBridger, WebSocket auth token for VTube Studio) --
worth a proper security scan on top of the existing build+test CI.
Runs on push/PR to main and weekly, manual build-mode (matches ci.yml's
own model-download step, autobuild doesn't handle this Gradle setup
well). Results surface in Security > Code scanning, not in this
workflow's own logs.
---
 .github/workflows/codeql.yml | 57 ++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..fca143f
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,57 @@
+name: CodeQL
+
+# Analyse de sécurité statique (build-mode manuel : l'auto-build de CodeQL gère mal ce Gradle
+# multi-module, et le modèle MediaPipe doit être présent avant toute compilation, comme dans
+# ci.yml). Se déclenche sur push/PR vers main (mêmes garde-fous que ci.yml) et une fois par
+# semaine pour attraper les nouvelles règles CodeQL même sans changement de code. Résultats dans
+# l'onglet Security > Code scanning, pas dans les logs de ce workflow.
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "17 3 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (java-kotlin)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+
+    steps:
+      - name: Récupérer le code
+        uses: actions/checkout@v7
+
+      - name: Installer le JDK 17
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - name: Configurer Gradle (cache "enhanced", gratuit sur repo public)
+        uses: gradle/actions/setup-gradle@v6
+
+      - name: Télécharger le modèle MediaPipe (voir README, non versionné)
+        run: |
+          mkdir -p app/src/main/assets
+          curl -fL -o app/src/main/assets/face_landmarker.task \
+            https://storage.googleapis.com/mediapipe-models/face_landmarker/face_landmarker/float16/latest/face_landmarker.task
+
+      - name: Initialiser CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: java-kotlin
+          build-mode: manual
+
+      - name: Build debug (nécessaire pour l'extraction CodeQL en build-mode manuel)
+        run: ./gradlew assembleDebug
+
+      - name: Exécuter l'analyse CodeQL
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:java-kotlin"

From 4243fd2c1d05f82ff54b5704feee96cdf0c5e88f Mon Sep 17 00:00:00 2001
From: Guyiome <guyiome.b@gmail.com>
Date: Thu, 20 Aug 2026 18:43:54 +0200
Subject: [PATCH 2/2] Fix CodeQL build: force a clean, uncached compile

First run failed ("could not process any code written in Java/Kotlin")
-- the build-and-test job had already populated the Gradle build
cache for this commit, so compileDebugKotlin came back UP-TO-DATE and
CodeQL never traced an actual compiler invocation. --no-build-cache
(plus clean) forces a real compile for the tracer to observe.
---
 .github/workflows/codeql.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fca143f..e84e9d0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -49,7 +49,10 @@ jobs:
           build-mode: manual
 
       - name: Build debug (nécessaire pour l'extraction CodeQL en build-mode manuel)
-        run: ./gradlew assembleDebug
+        # --no-build-cache : sans ça, si build-and-test a déjà tourné sur ce même commit,
+        # compileDebugKotlin ressort UP-TO-DATE/FROM-CACHE, aucun compilateur n'est réellement
+        # invoqué et CodeQL échoue avec "could not process any code written in Java/Kotlin".
+        run: ./gradlew clean assembleDebug --no-build-cache
 
       - name: Exécuter l'analyse CodeQL
         uses: github/codeql-action/analyze@v3