Add Detekt static analysis

.github/workflows/pr.yml

@@ -159,6 +159,30 @@ jobs:
         with:
           category: "KTlint"
 
+  detekt:
+    needs: [lockfiles, yamllint]
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup-build-env
+        with:
+          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          mock-google-services: "true"
+
+      # Since `build-logic` is added with `includeBuild` we have to call detekt explicitly on `:convention`.
+      - name: Validate Detekt
+        run: ./gradlew detekt :build-logic:convention:detekt --continue
+
+      - uses: ./.github/actions/upload-sarif-results
+        if: always()
+        with:
+          category: "Detekt"
+
   lint:
     needs: [lockfiles, ktlint]
     runs-on: ubuntu-latest
@@ -191,7 +215,7 @@ jobs:
 
   screenshot_test:
     name: "Screenshot Tests"
-    needs: [lint, lockfiles, ktlint]
+    needs: [detekt, lint, lockfiles, ktlint]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -298,7 +322,7 @@ jobs:
 
   unit_tests:
     name: "Unit Tests"
-    needs: [lint, lockfiles, ktlint]
+    needs: [detekt, lint, lockfiles, ktlint]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -321,7 +345,7 @@ jobs:
 
   build_emulator_wtf_apks:
     name: "Build Emulator.wtf APKs"
-    needs: [lint, lockfiles, ktlint]
+    needs: [detekt, lint, lockfiles, ktlint]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -361,7 +385,7 @@ jobs:
 
   instrumentation_test:
     name: "Instrumentation Tests"
-    needs: [lint, lockfiles, ktlint]
+    needs: [detekt, lint, lockfiles, ktlint]
     runs-on: ubuntu-latest
     strategy:
       # We want the result of each device to be reported, so we can't fail-fast

build-logic/convention/build.gradle.kts

@@ -1,14 +1,17 @@
+import dev.detekt.gradle.Detekt
 import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 import org.jlleitschuh.gradle.ktlint.reporter.ReporterType
 
 plugins {
     `kotlin-dsl`
+    alias(libs.plugins.detekt)
     alias(libs.plugins.ktlint)
 }
 
 group = "io.homeassistant.companion.android.buildlogic"
 
 allprojects {
+    apply(plugin = rootProject.libs.plugins.detekt.get().pluginId)
     apply(plugin = rootProject.libs.plugins.ktlint.get().pluginId)
 
     ktlint {
@@ -24,6 +27,19 @@ allprojects {
             exclude { it.file.path.contains("build${File.separator}generated-sources") }
         }
     }
+
+    detekt {
+        baseline = rootProject.file("../config/detekt/baseline-$name.xml")
+        config.setFrom(rootProject.file("../config/detekt/detekt.yml"))
+        buildUponDefaultConfig = true
+    }
+
+    tasks.withType<Detekt>().configureEach {
+        reports {
+            html.required.set(true)
+            sarif.required.set(true)
+        }
+    }
 }
 
 // Configure the build-logic plugins to target JDK 17 and is not related to what is running on device.

build.gradle.kts

@@ -1,8 +1,10 @@
+import dev.detekt.gradle.Detekt
 import org.jlleitschuh.gradle.ktlint.reporter.ReporterType
 
 val kotlinVersion = libs.versions.kotlin.get()
 
 plugins {
+    alias(libs.plugins.detekt)
     alias(libs.plugins.ktlint)
 
     alias(libs.plugins.aboutlibraries).apply(false)
@@ -20,6 +22,7 @@ plugins {
 }
 
 allprojects {
+    apply(plugin = rootProject.libs.plugins.detekt.get().pluginId)
     apply(plugin = rootProject.libs.plugins.ktlint.get().pluginId)
 
     // TODO this has been added until https://youtrack.jetbrains.com/issue/KT-87220/Kotlin-Gradle-plugin-resolves-kotlinAbiValidationCompatClasspath-to-newer-beta-Kotlin-artifacts-during-dependency-locking is addressed
@@ -54,6 +57,19 @@ allprojects {
         }
     }
 
+    detekt {
+        baseline = rootProject.file("config/detekt/baseline-$name.xml")
+        config.setFrom(rootProject.file("config/detekt/detekt.yml"))
+        buildUponDefaultConfig = true
+    }
+
+    tasks.withType<Detekt>().configureEach {
+        reports {
+            html.required.set(true)
+            sarif.required.set(true)
+        }
+    }
+
     dependencyLocking {
         lockAllConfigurations()
     }