Add Detekt static analysis

.github/workflows/pr.yml

@@ -159,6 +159,31 @@ jobs:
         with:
           category: "KTlint"
 
+  detekt:
+    needs: [lockfiles, yamllint]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup-build-env
+        with:
+          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          mock-google-services: "true"
+
+      # Since `build-logic` is added with `includeBuild` we have to call detektMain explicitly on `:convention`.
+      - name: Validate Detekt
+        run: ./gradlew detektMain :build-logic:convention:detektMain --continue
+
+      - uses: ./.github/actions/upload-sarif-results
+        if: always()
+        with:
+          category: "Detekt"
+
   lint:
     needs: [lockfiles, ktlint]
     runs-on: ubuntu-latest
@@ -191,7 +216,7 @@ jobs:
 
   screenshot_test:
     name: "Screenshot Tests"
-    needs: [lint, lockfiles, ktlint]
+    needs: [detekt, lint, lockfiles, ktlint]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -299,7 +324,7 @@ jobs:
 
   unit_tests:
     name: "Unit Tests"
-    needs: [lint, lockfiles, ktlint]
+    needs: [detekt, lint, lockfiles, ktlint]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -323,7 +348,7 @@ jobs:
 
   build_emulator_wtf_apks:
     name: "Build Emulator.wtf APKs"
-    needs: [lint, lockfiles, ktlint]
+    needs: [detekt, lint, lockfiles, ktlint]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -363,7 +388,7 @@ jobs:
 
   instrumentation_test:
     name: "Instrumentation Tests"
-    needs: [lint, lockfiles, ktlint]
+    needs: [detekt, lint, lockfiles, ktlint]
     runs-on: ubuntu-latest
     strategy:
       # We want the result of each device to be reported, so we can't fail-fast

automotive/build.gradle.kts

@@ -89,6 +89,11 @@ android {
     }
 }
 
+detekt {
+    // Automotive reuses the app's Kotlin source sets, which are already analyzed by :app.
+    ignoredFlavors = listOf("full", "minimal")
+}
+
 dependencies {
     // Most of the dependencies are coming from the convention plugin to avoid duplication with `:app` module.
     implementation(libs.car.automotive)

build-logic/convention/build.gradle.kts

@@ -1,8 +1,10 @@
+import dev.detekt.gradle.Detekt
 import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 import org.jlleitschuh.gradle.ktlint.reporter.ReporterType
 
 plugins {
     `kotlin-dsl`
+    alias(libs.plugins.detekt)
     alias(libs.plugins.ktlint)
 }
 
@@ -26,6 +28,19 @@ allprojects {
     }
 }
 
+detekt {
+    baseline = project.file("detekt-baseline.xml")
+    config.setFrom(rootProject.file("../config/detekt/detekt.yml"))
+    buildUponDefaultConfig = true
+}
+
+tasks.withType<Detekt>().configureEach {
+    reports {
+        html.required.set(true)
+        sarif.required.set(true)
+    }
+}
+
 // Configure the build-logic plugins to target JDK 17 and is not related to what is running on device.
 java {
     sourceCompatibility = JavaVersion.VERSION_17

build-logic/convention/detekt-baseline-main.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" ?>
+<SmellBaseline>
+  <ManuallySuppressedIssues/>
+  <CurrentIssues>
+    <ID>LongMethod:AndroidApplicationDependenciesConventionPlugin.kt:AndroidApplicationDependenciesConventionPlugin$override fun apply</ID>
+    <ID>LongMethod:AndroidCommonConventionPlugin.kt:AndroidCommonConventionPlugin$override fun apply</ID>
+    <ID>MagicNumber:AndroidComposeConventionPlugin.kt:AndroidComposeConventionPlugin$0.00025f</ID>
+  </CurrentIssues>
+</SmellBaseline>

build-logic/convention/detekt-baseline.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" ?>
+<SmellBaseline>
+  <ManuallySuppressedIssues/>
+  <CurrentIssues>
+    <ID>LongMethod:AndroidApplicationDependenciesConventionPlugin.kt:AndroidApplicationDependenciesConventionPlugin$override fun apply</ID>
+    <ID>LongMethod:AndroidCommonConventionPlugin.kt:AndroidCommonConventionPlugin$override fun apply</ID>
+    <ID>MagicNumber:AndroidComposeConventionPlugin.kt:AndroidComposeConventionPlugin$0.00025f</ID>
+  </CurrentIssues>
+</SmellBaseline>

build.gradle.kts

@@ -1,8 +1,10 @@
+import dev.detekt.gradle.Detekt
 import org.jlleitschuh.gradle.ktlint.reporter.ReporterType
 
 val kotlinVersion = libs.versions.kotlin.get()
 
 plugins {
+    alias(libs.plugins.detekt)
     alias(libs.plugins.ktlint)
 
     alias(libs.plugins.aboutlibraries).apply(false)
@@ -20,6 +22,7 @@ plugins {
 }
 
 allprojects {
+    apply(plugin = rootProject.libs.plugins.detekt.get().pluginId)
     apply(plugin = rootProject.libs.plugins.ktlint.get().pluginId)
 
     // TODO this has been added until https://youtrack.jetbrains.com/issue/KT-87220/Kotlin-Gradle-plugin-resolves-kotlinAbiValidationCompatClasspath-to-newer-beta-Kotlin-artifacts-during-dependency-locking is addressed
@@ -54,6 +57,19 @@ allprojects {
         }
     }
 
+    detekt {
+        baseline = project.file("detekt-baseline.xml")
+        config.setFrom(rootProject.file("config/detekt/detekt.yml"))
+        buildUponDefaultConfig = true
+    }
+
+    tasks.withType<Detekt>().configureEach {
+        reports {
+            html.required.set(true)
+            sarif.required.set(true)
+        }
+    }
+
     dependencyLocking {
         lockAllConfigurations()
     }