From 9d6326e2d539147f04b46c39d01e8b36f059f37b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marcin=20Zieli=C5=84ski?= <m.zielinski@avsystem.com>
Date: Mon, 27 Jul 2026 17:44:45 +0200
Subject: [PATCH 1/3] Add codeql yml file

---
 .github/workflows/codeql.yml | 77 ++++++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..0225bafe
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,77 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+  schedule:
+    - cron: '27 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  analyze:
+    name: Analyze (java-kotlin)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 21
+
+      - uses: gradle/actions/setup-gradle@v4
+        with:
+          # Only master writes the cache; PRs read it. Keeps the cache from being
+          # polluted by branch builds while still avoiding the wrapper download.
+          cache-read-only: ${{ github.ref != 'refs/heads/master' }}
+
+      # The distribution download from services.gradle.org is the flaky part.
+      # Do it here, outside the traced build, and retry instead of failing the run.
+      - name: Warm up Gradle
+        run: |
+          for attempt in 1 2 3; do
+            if ./gradlew --version; then exit 0; fi
+            delay=$((attempt * 15))
+            echo "::warning::Gradle distribution download failed (attempt ${attempt}/3), retrying in ${delay}s"
+            sleep "${delay}"
+          done
+          echo "::error::Could not provision Gradle after 3 attempts"
+          exit 1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: java-kotlin
+          build-mode: manual
+          # Drop this line to fall back to the default suite if the extra
+          # lower-precision queries turn out to be too noisy.
+          queries: security-extended
+
+      # CodeQL builds its database by tracing the compiler, so compilation must
+      # actually happen: gradle.properties enables the build and configuration
+      # caches, both of which would let Gradle skip the work and leave CodeQL
+      # with an empty database.
+      - name: Build
+        run: ./gradlew classes --no-daemon --no-build-cache --no-configuration-cache
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: /language:java-kotlin
+          upload: never

From f0652cc80945d161bf28c0ff22644535aef40a0d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marcin=20Zieli=C5=84ski?= <m.zielinski@avsystem.com>
Date: Mon, 27 Jul 2026 18:07:44 +0200
Subject: [PATCH 2/3] ci: upload CodeQL results

Drop the temporary `upload: never` used to validate the traced build while
the code quality ruleset rule was still active.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0225bafe..0ce4c2de 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -74,4 +74,3 @@ jobs:
         uses: github/codeql-action/analyze@v3
         with:
           category: /language:java-kotlin
-          upload: never

From b8719be513d3c03276b5f2df964f1c34847ec703 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marcin=20Zieli=C5=84ski?= <m.zielinski@avsystem.com>
Date: Mon, 27 Jul 2026 18:33:22 +0200
Subject: [PATCH 3/3] Improve PR

---
 .github/workflows/codeql.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0ce4c2de..e01e9fb8 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -47,6 +47,7 @@ jobs:
         run: |
           for attempt in 1 2 3; do
             if ./gradlew --version; then exit 0; fi
+            if [ "${attempt}" -eq 3 ]; then break; fi
             delay=$((attempt * 15))
             echo "::warning::Gradle distribution download failed (attempt ${attempt}/3), retrying in ${delay}s"
             sleep "${delay}"