From 6255670f55cf3e49cc8ad1fca9db1686abb597f4 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 25 Oct 2026 22:00:54 +0000
Subject: [PATCH] Include the unit tests in the CodeQL scan [no-new-version]

autobuild runs gradle assemble, which does not compile the unit tests,
so CodeQL scanned 13 of the 17 Java files. Build manually with the debug
unit test sources too, without the build cache so that javac always runs
under the CodeQL tracer, on JDK 21 like the Test job.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0178vjPYCurDqWnpvkLsVmZ1
---
 .github/workflows/codeql.yml | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index be4fe32..91d928c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -21,7 +21,8 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
-  JAVA_VERSION: '17'
+  # Same JDK as the Test job in ci.yml, which builds the unit tests (Robolectric needs JDK 21)
+  JAVA_VERSION: '21'
 
 jobs:
   analyze:
@@ -36,9 +37,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          # Built with Gradle so that the AndroidX dependencies are resolved
+          # Built with Gradle so that the AndroidX dependencies are resolved; manual rather than
+          # autobuild, whose `assemble` leaves the unit tests out of the scan
           - language: java-kotlin
-            build-mode: autobuild
+            build-mode: manual
           - language: actions
             build-mode: none
 
@@ -48,14 +50,14 @@ jobs:
           persist-credentials: false
 
       - name: Setup JDK
-        if: matrix.build-mode == 'autobuild'
+        if: matrix.build-mode == 'manual'
         uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: ${{ env.JAVA_VERSION }}
 
       - name: Setup Gradle
-        if: matrix.build-mode == 'autobuild'
+        if: matrix.build-mode == 'manual'
         uses: gradle/actions/setup-gradle@v6
 
       - name: Initialize CodeQL
@@ -64,6 +66,15 @@ jobs:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
+      # Without the build cache, so that javac runs and CodeQL sees every source file
+      - name: Build
+        if: matrix.build-mode == 'manual'
+        run: |
+          ./gradlew --no-daemon --no-build-cache \
+            :flowlayoutmanager:assembleDebug \
+            :flowlayoutmanager:compileDebugUnitTestJavaWithJavac \
+            :app:assembleDebug
+
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4
         with: