fix: SAST Java-only build, Secret base/head, Swift AnyCodable

- security-scan: Build only :java-client:compileJava (avoid Kotlin 2.3)
- secret-scan: base/head from event.before and PR refs so BASE != HEAD
- swift-enhanced: add AnyCodable dep + import for entityContext type

Author: MaxLuxs

.github/workflows/security-scan.yml

@@ -47,12 +47,13 @@ jobs:
         with:
           fetch-depth: 0
 
+      # On push use event.before so BASE != HEAD; on PR use PR base/head
       - name: TruffleHog Scan
         uses: trufflesecurity/trufflehog@main
         with:
           path: ./
-          base: ${{ github.event.repository.default_branch }}
-          head: HEAD
+          base: ${{ github.event.pull_request.base.sha || github.event.before || github.event.repository.default_branch }}
+          head: ${{ github.event.pull_request.head.sha || github.sha }}
 
   container-scan:
     name: Container Image Scan
@@ -103,8 +104,9 @@ jobs:
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
 
+      # Build only Java to avoid Kotlin (CodeQL Kotlin extractor does not support 2.3)
       - name: Build
-        run: ./gradlew build -x test --no-daemon
+        run: ./gradlew :java-client:compileJava --no-daemon
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4

sdk/swift-enhanced/Package.swift

@@ -15,13 +15,13 @@ let package = Package(
         ),
     ],
     dependencies: [
-        // Base SDK dependency - in production, use: .package(url: "...", from: "1.0.0")
         .package(path: "../swift"),
+        .package(url: "https://github.com/Flight-School/AnyCodable", .upToNextMajor(from: "0.6.1")),
     ],
     targets: [
         .target(
             name: "FlagentEnhanced",
-            dependencies: ["FlagentClient"],
+            dependencies: ["FlagentClient", "AnyCodable"],
             path: "Sources/FlagentEnhanced"
         ),
         .testTarget(

sdk/swift-enhanced/Sources/FlagentEnhanced/Manager/FlagentManager.swift

@@ -1,6 +1,7 @@
 import Foundation
 import Combine
 import FlagentClient
+import AnyCodable
 
 // Helper extension to convert Combine publishers to async/await
 extension AnyPublisher {