ci: add CodeQL analysis

.github/cloudbuild/flutter-windows.yaml

@@ -7,7 +7,6 @@ substitutions:
   #   This allows to use more resources simultaneously as different machine types in different regions don't share quotas.
   _CE_REGION: us-central1
   _CE_ZONE: us-central1-f
-  _CE_MACHINE_TYPE: n2-standard-4
 
 steps:
   # We need this step to correctly identify dockerfile tag

.github/workflows/android-build-test.yml

@@ -291,6 +291,7 @@ jobs:
         name: Trigger App Automate
         env:
           BROWSERSTACK_CREDENTIALS: ${{ secrets.BROWSERSTACK_CREDENTIALS }}
+          BROWSERSTACK_PROJECT: ${{ github.event.repository.name }}
           BROWSERSTACK_APP: ${{ env.MAIN_APK_NAME }}
           BROWSERSTACK_TEST_SUITE: ${{ env.HELPER_APK_NAME }}
           BROWSERSTACK_BUILD_TAG: ${{ github.run_number }}
@@ -363,6 +364,7 @@ jobs:
         name: Trigger App Automate
         env:
           BROWSERSTACK_CREDENTIALS: ${{ secrets.BROWSERSTACK_CREDENTIALS }}
+          BROWSERSTACK_PROJECT: ${{ github.event.repository.name }}
           BROWSERSTACK_APP: ${{ env.MAIN_APK_NAME }}
           BROWSERSTACK_TEST_SUITE: ${{ env.HELPER_APK_NAME }}
           BROWSERSTACK_BUILD_TAG: ${{ github.run_number }}
@@ -381,7 +383,7 @@ jobs:
       - build-android-apk
       - test-android-apk-unified
     runs-on: ubuntu-22.04
-    # if: github.ref == 'refs/heads/master'
+    if: vars.DEPLOY_PLAYSTORE == 'true'
     steps:
       - uses: actions/checkout@v4
       - name: Set up authentication for Google Cloud SDK

.github/workflows/code-analysis.yml

@@ -83,3 +83,22 @@ jobs:
           cache-to: type=gha,mode=max
       - name: Scan code
         run: make docker/scanner/scan
+
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: java-kotlin, javascript-typescript, python, actions
+          build-mode: none
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.github/workflows/scripts/browserstack-app-automate.sh

@@ -3,7 +3,6 @@
 # This script is used to trigger a build on BrowserStack App Automate and monitor its status.
 
 # Build parameters
-PROJECT="mobile-app-build-290400"
 DEVICE_LOGS=true
 RETRY_INTERVAL=10
 
@@ -13,6 +12,7 @@ STATUS_URL="https://api-cloud.browserstack.com/app-automate/flutter-integration-
 
 # Retrieve vars from environment variables
 CREDENTIALS="${BROWSERSTACK_CREDENTIALS:-}"
+PROJECT="${BROWSERSTACK_PROJECT:-}"
 APP="${BROWSERSTACK_APP:-}"
 TEST_SUITE="${BROWSERSTACK_TEST_SUITE:-}"
 BUILD_TAG="${BROWSERSTACK_BUILD_TAG:-}"
@@ -26,7 +26,7 @@ fi
 
 if [[ -z "$APP" || -z "$TEST_SUITE" || -z "$BUILD_TAG" || -z "$DEVICES" ]]; then
   echo "Error: Environment variables"\
-  "BROWSERSTACK_APP, BROWSERSTACK_TEST_SUITE, BROWSERSTACK_BUILD_TAG and BROWSERSTACK_DEVICES"\
+  "BROWSERSTACK_PROJECT, BROWSERSTACK_APP, BROWSERSTACK_TEST_SUITE, BROWSERSTACK_BUILD_TAG and BROWSERSTACK_DEVICES"\
   "must be set."
   exit 1
 fi
@@ -67,11 +67,13 @@ check_build_status() {
   # Display device status
   if [[ "$status" != "running" ]]; then
     echo "$response" | jq -r '
-      .devices[] |
-      "Device: " + .device +
-      ", OS Version: " + .os_version +
-      ", Duration: " + (.sessions[0].duration | tostring) + "s" +
-      ", Status: " + (.sessions[0].status)
+      "App: " + .input_capabilities.app +
+      ( .devices[] |
+        ", Device: " + .device +
+        ", OS Version: " + .os_version +
+        ", Duration: " + (.sessions[0].duration | tostring) + "s" +
+        ", Status: " + (.sessions[0].status)
+      )
     '
   fi
 

flutter/integration_test/expected_throughput.dart

@@ -39,8 +39,8 @@ const _kIphoneOnMacbookM1 = 'iPhone14,7';
 
 const Map<String, Map<String, Interval>> _imageClassificationV2 = {
   _kTFLiteBackend: {
-    _kCloudBuildX23: Interval(min: 1, max: 9),
-    _kCloudBuildX28: Interval(min: 1, max: 9),
+    _kCloudBuildX23: Interval(min: 0.5, max: 9),
+    _kCloudBuildX28: Interval(min: 0.5, max: 9),
     _kRyzen5600: Interval(min: 1, max: 37),
     _kPixel5: Interval(min: 20, max: 75),
     _kPixel6: Interval(min: 100, max: 600),
@@ -70,8 +70,8 @@ const Map<String, Map<String, Interval>> _imageClassificationV2 = {
 
 const Map<String, Map<String, Interval>> _objectDetection = {
   _kTFLiteBackend: {
-    _kCloudBuildX23: Interval(min: 4, max: 7),
-    _kCloudBuildX28: Interval(min: 3.5, max: 8),
+    _kCloudBuildX23: Interval(min: 2, max: 7),
+    _kCloudBuildX28: Interval(min: 2, max: 8),
     _kRyzen5600: Interval(min: 14, max: 22),
     _kPixel5: Interval(min: 40, max: 60),
     _kPixel6: Interval(min: 100, max: 450),
@@ -226,8 +226,8 @@ const Map<String, Map<String, Interval>> _stableDiffusion = {
 
 const Map<String, Map<String, Interval>> _imageClassificationOfflineV2 = {
   _kTFLiteBackend: {
-    _kCloudBuildX23: Interval(min: 1, max: 9),
-    _kCloudBuildX28: Interval(min: 1, max: 9),
+    _kCloudBuildX23: Interval(min: 0.8, max: 9),
+    _kCloudBuildX28: Interval(min: 0.8, max: 9),
     _kRyzen5600: Interval(min: 20, max: 60),
     _kPixel5: Interval(min: 20, max: 180),
     _kPixel6: Interval(min: 100, max: 700),