Merge CodeQL & Build GitHub Actions (re. google#2294)

.github/workflows/build.yml

@@ -50,6 +50,8 @@ jobs:
 
     strategy:
       fail-fast: false
+      matrix:
+        language: [ 'java' ]
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
@@ -62,8 +64,36 @@ jobs:
           # https://github.com/diffplug/spotless/issues/1242
           fetch-depth: 0
 
-      - name: Setup machine
-        uses: ./.github/actions/commonSetup
+      - name: Switch to Java 17 from Eclipse Temurin distro
+        uses: actions/setup-java@v3
+        with:
+          java-version: 17
+          distribution: temurin
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Build (minimal, for CodeQL) with Gradle
+        run: ./gradlew --scan --full-stacktrace compileDebugAndroidTestSources
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+        with:
+          category: "/language:${{matrix.language}}"
+
+      # This needs to be done *AFTER* CodeQL; otherwise it fails weirdly, see https://github.com/google/android-fhir/issues/2310
+      - name: "Setup Gradle"
+        uses: gradle/gradle-build-action@v2
+        with:
+          # See https://github.com/marketplace/actions/gradle-build-action#enable-dependency-graph-generation-for-a-workflow
+          dependency-graph: generate-and-submit
+          # Limit the size of the cache entry.
+          # These directories contain instrumented/transformed dependency jars which can be reconstructed relatively quickly.
+          gradle-home-cache-excludes: |
+            caches/jars-9
+            caches/transforms-3
 
       - name: Spotless check
         run: ./gradlew spotlessCheck --scan --full-stacktrace