From 4e44b9abb989d421a0763ecfc22d612c4a42c0e0 Mon Sep 17 00:00:00 2001
From: Sascha Peilicke <sascha@peilicke.de>
Date: Thu, 12 Sep 2024 15:30:47 +0200
Subject: [PATCH] Consolidate CI workflows and update JDK version

Removed existing Gradle build and validation workflows, replacing them
with a new unified CI configuration. Updated JDK version to 21 and added
a security workflow utilizing MobSF scan and GitHub CodeQL.
---
 .github/workflows/gradle-build.yml            | 24 --------------
 .../workflows/gradle-wrapper-validation.yml   | 10 ------
 .github/workflows/main.yml                    | 33 +++++++++++++++++++
 .github/workflows/security.yml                | 33 +++++++++++++++++++
 4 files changed, 66 insertions(+), 34 deletions(-)
 delete mode 100644 .github/workflows/gradle-build.yml
 delete mode 100644 .github/workflows/gradle-wrapper-validation.yml
 create mode 100644 .github/workflows/main.yml
 create mode 100644 .github/workflows/security.yml

diff --git a/.github/workflows/gradle-build.yml b/.github/workflows/gradle-build.yml
deleted file mode 100644
index 0774821..0000000
--- a/.github/workflows/gradle-build.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: Gradle Build
-on: [push]
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-        with:
-          lfs: true
-      - name: Set up JDK 11
-        uses: actions/setup-java@v1
-        with:
-          java-version: 11
-      - uses: actions/cache@v1
-        with:
-          path: ~/.gradle/caches
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle.kts') }}
-          restore-keys: |
-            ${{ runner.os }}-gradle-
-      - name: Setup Android problem matchers
-        uses: jonasb/android-problem-matchers-action@v1
-      - name: Build with Gradle
-        run: ./gradlew build
diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml
deleted file mode 100644
index f552c8d..0000000
--- a/.github/workflows/gradle-wrapper-validation.yml
+++ /dev/null
@@ -1,10 +0,0 @@
-name: "Validate Gradle Wrapper"
-on: [push]
-
-jobs:
-  validation:
-    name: "Validation"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: gradle/wrapper-validation-action@v1
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
new file mode 100644
index 0000000..15cf15f
--- /dev/null
+++ b/.github/workflows/main.yml
@@ -0,0 +1,33 @@
+name: Main CI
+on: [ push ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  spotless:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+      - name: Run Spotless
+        run: ./gradlew spotlessCheck
+
+  build:
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+      - name: Setup Android problem matchers
+        uses: jonasb/android-problem-matchers-action@v1
+      - name: Build with Gradle
+        run: ./gradlew build
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..111942e
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,33 @@
+name: Security
+on: [push]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  mobfs:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Python 3.10
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+      - name: Run mobsfscan
+        uses: MobSF/mobsfscan@0.3.4
+        with:
+          args: . --sarif --output results.sarif || true
+      - name: Upload mobsfscan report
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: results.sarif
+
+  gradle-validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: gradle/wrapper-validation-action@v1
\ No newline at end of file