From 9ef18c745f36d7b2448183df31099e6647ae3d83 Mon Sep 17 00:00:00 2001
From: Satoshi Qazi Muhammed <info@pezkuwichain.io>
Date: Tue, 3 Nov 2026 03:56:34 +0400
Subject: [PATCH] Run CodeQL for every language on hosted runners, Kotlin with
 a build

Default setup analyses Java without a build and leaves out every Kotlin file, and the Java job on the
self-hosted runner stopped at the NDK install because sudo asks for a password, so Kotlin had not been
analysed since February. One matrix job covers actions, JavaScript/TypeScript, Rust and Java/Kotlin.
---
 .github/workflows/security.yml | 39 ++++++++++++++++++++++++++++++----
 1 file changed, 35 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 195c1e79..022cf72d 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -26,24 +26,51 @@ env:
   EHTERSCAN_API_KEY_ETHEREUM: ${{ secrets.EHTERSCAN_API_KEY_ETHEREUM }}
   INFURA_API_KEY: ${{ secrets.INFURA_API_KEY }}
   DWELLIR_API_KEY: ${{ secrets.DWELLIR_API_KEY }}
+  TRONGRID_API_KEY: ${{ secrets.TRONGRID_API_KEY }}
   WALLET_CONNECT_PROJECT_ID: ${{ secrets.WALLET_CONNECT_PROJECT_ID }}
   DEBUG_GOOGLE_OAUTH_ID: ${{ secrets.DEBUG_GOOGLE_OAUTH_ID }}
   RELEASE_GOOGLE_OAUTH_ID: ${{ secrets.RELEASE_GOOGLE_OAUTH_ID }}
 
 jobs:
   codeql:
-    name: CodeQL Analysis
-    runs-on: [self-hosted, wallet]
-    if: github.event_name == 'push'  # Only run on push, not PRs (self-hosted security)
+    # Advanced setup, because default setup analyses Java without a build and leaves out every
+    # Kotlin file, which is nearly all of this app.
+    name: CodeQL (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: javascript-typescript
+            build-mode: none
+          - language: rust
+            build-mode: none
+          - language: java-kotlin
+            build-mode: manual
 
     steps:
+      - name: Free disk space
+        if: matrix.language == 'java-kotlin'
+        run: |
+          # The CodeQL bundle in the tool cache is kept: the init step below uses it.
+          sudo rm -rf /usr/share/dotnet /usr/share/swift /opt/ghc /usr/local/.ghcup \
+            /usr/local/share/boost /usr/local/share/powershell \
+            /usr/local/lib/node_modules /usr/local/julia* /opt/microsoft
+          sudo docker image prune -af > /dev/null 2>&1 || true
+          df -h /
+
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Install dependencies
+        if: matrix.language == 'java-kotlin'
         uses: ./.github/workflows/install/
 
       - name: Set up DEV Google Services
+        if: matrix.language == 'java-kotlin'
         uses: davidSchuppa/base64Secret-toFile-action@v3
         with:
           secret: ${{ secrets.CI_DEVELOP_GOOGLE_SERVICES }}
@@ -53,15 +80,19 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
         with:
-          languages: java-kotlin
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
 
       - name: Build for CodeQL
+        if: matrix.build-mode == 'manual'
         run: ./gradlew assembleDebug -x test -x lint
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v3
+        with:
+          category: /language:${{ matrix.language }}
 
   dependency-review:
     name: Dependency Review