From ea796bdee9c977deb4d7ecf8d7aaec593541e286 Mon Sep 17 00:00:00 2001 From: Rebecca Franks Date: Wed, 16 Sep 2026 11:02:26 +0100 Subject: [PATCH] Fix YAML files and pinned versions --- .github/workflows/JetLagged.yaml | 17 +++++++++++------ .github/workflows/JetNews.yaml | 17 +++++++++++------ .github/workflows/Jetcaster.yaml | 3 +++ .github/workflows/Jetchat.yaml | 17 +++++++++++------ .github/workflows/Jetsnack.yaml | 3 +++ .github/workflows/Release.yml | 10 ++++++++-- .github/workflows/Reply.yaml | 17 +++++++++++------ .github/workflows/build-sample.yml | 15 ++++++++++----- .github/workflows/default-check.yml | 7 ++++++- .github/workflows/update_deps.yml | 13 ++++++++++--- 10 files changed, 84 insertions(+), 35 deletions(-) diff --git a/.github/workflows/JetLagged.yaml b/.github/workflows/JetLagged.yaml index 6c38e16bf6..f7ee31f8d4 100644 --- a/.github/workflows/JetLagged.yaml +++ b/.github/workflows/JetLagged.yaml @@ -13,6 +13,9 @@ on: - 'JetLagged/**' workflow_dispatch: +permissions: + contents: read + env: SAMPLE_PATH: JetLagged compose_store_password: ${{ secrets.COMPOSE_STORE_PASSWORD }} @@ -35,17 +38,19 @@ jobs: timeout-minutes: 30 strategy: matrix: - api-level: [23, 26, 29] + api-level: [24, 26] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Copy CI gradle.properties run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 17 distribution: 'zulu' @@ -53,7 +58,7 @@ jobs: - name: Generate cache key run: ./scripts/checksum.sh $SAMPLE_PATH checksum.txt - - uses: actions/cache@v5 + - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: | ~/.gradle/caches/modules-* @@ -62,7 +67,7 @@ jobs: key: gradle-${{ hashFiles('checksum.txt') }} - name: Run instrumentation tests - uses: reactivecircus/android-emulator-runner@v2 + uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0 with: api-level: ${{ matrix.api-level }} arch: x86 @@ -72,7 +77,7 @@ jobs: - name: Upload test reports if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: test-reports-jetlagged-${{ matrix.api-level }} path: ${{ env.SAMPLE_PATH }}/app/build/reports diff --git a/.github/workflows/JetNews.yaml b/.github/workflows/JetNews.yaml index 6fbdd6f102..90fa3765ce 100644 --- a/.github/workflows/JetNews.yaml +++ b/.github/workflows/JetNews.yaml @@ -13,6 +13,9 @@ on: - 'JetNews/**' workflow_dispatch: +permissions: + contents: read + env: SAMPLE_PATH: JetNews compose_store_password: ${{ secrets.compose_store_password }} @@ -35,11 +38,13 @@ jobs: timeout-minutes: 30 strategy: matrix: - api-level: [23, 26, 29] + api-level: [24, 26] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Enable KVM group perms run: | echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules @@ -49,7 +54,7 @@ jobs: run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 17 distribution: 'zulu' @@ -57,7 +62,7 @@ jobs: - name: Generate cache key run: ./scripts/checksum.sh $SAMPLE_PATH checksum.txt - - uses: actions/cache@v5 + - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: | ~/.gradle/caches/modules-* @@ -65,7 +70,7 @@ jobs: ~/.gradle/caches/build-cache-* key: gradle-${{ hashFiles('checksum.txt') }} - name: Run instrumentation tests - uses: reactivecircus/android-emulator-runner@v2 + uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0 with: api-level: ${{ matrix.api-level }} arch: x86 @@ -75,7 +80,7 @@ jobs: - name: Upload test reports if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: test-reports-jetnews-${{ matrix.api-level }} path: ${{ env.SAMPLE_PATH }}/app/build/reports/androidTests diff --git a/.github/workflows/Jetcaster.yaml b/.github/workflows/Jetcaster.yaml index 44c15fe1ce..ee983fa657 100644 --- a/.github/workflows/Jetcaster.yaml +++ b/.github/workflows/Jetcaster.yaml @@ -13,6 +13,9 @@ on: - 'Jetcaster/**' workflow_dispatch: +permissions: + contents: read + jobs: build: uses: ./.github/workflows/build-sample.yml diff --git a/.github/workflows/Jetchat.yaml b/.github/workflows/Jetchat.yaml index 51818d2316..da3b6dc555 100644 --- a/.github/workflows/Jetchat.yaml +++ b/.github/workflows/Jetchat.yaml @@ -13,6 +13,9 @@ on: - 'Jetchat/**' workflow_dispatch: +permissions: + contents: read + env: SAMPLE_PATH: Jetchat compose_store_password: ${{ secrets.compose_store_password }} @@ -34,17 +37,19 @@ jobs: timeout-minutes: 30 strategy: matrix: - api-level: [23, 26, 29] + api-level: [24, 26] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Copy CI gradle.properties run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 17 distribution: 'zulu' @@ -52,7 +57,7 @@ jobs: - name: Generate cache key run: ./scripts/checksum.sh $SAMPLE_PATH checksum.txt - - uses: actions/cache@v5 + - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: | ~/.gradle/caches/modules-* @@ -61,7 +66,7 @@ jobs: key: gradle-${{ hashFiles('checksum.txt') }} - name: Run instrumentation tests - uses: reactivecircus/android-emulator-runner@v2 + uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0 with: api-level: ${{ matrix.api-level }} arch: x86 @@ -71,7 +76,7 @@ jobs: - name: Upload test reports if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: test-reports-jetchat-${{ matrix.api-level }} path: ${{ env.SAMPLE_PATH }}/app/build/reports diff --git a/.github/workflows/Jetsnack.yaml b/.github/workflows/Jetsnack.yaml index 1962c2c789..bfd9c8d27a 100644 --- a/.github/workflows/Jetsnack.yaml +++ b/.github/workflows/Jetsnack.yaml @@ -13,6 +13,9 @@ on: - 'Jetsnack/**' workflow_dispatch: +permissions: + contents: read + jobs: build: uses: ./.github/workflows/build-sample.yml diff --git a/.github/workflows/Release.yml b/.github/workflows/Release.yml index 04499c3dca..e64a1048c5 100644 --- a/.github/workflows/Release.yml +++ b/.github/workflows/Release.yml @@ -4,6 +4,10 @@ on: push: tags: - 'v*' + +permissions: + contents: read + env: compose_store_password: ${{ secrets.COMPOSE_STORE_PASSWORD }} compose_key_alias: ${{ secrets.COMPOSE_KEY_ALIAS }} @@ -15,13 +19,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Copy CI gradle.properties run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 17 distribution: 'zulu' diff --git a/.github/workflows/Reply.yaml b/.github/workflows/Reply.yaml index 2168aa9cb0..2cd3ae64cd 100644 --- a/.github/workflows/Reply.yaml +++ b/.github/workflows/Reply.yaml @@ -13,6 +13,9 @@ on: - 'Reply/**' workflow_dispatch: +permissions: + contents: read + env: SAMPLE_PATH: Reply compose_store_password: ${{ secrets.COMPOSE_STORE_PASSWORD }} @@ -35,17 +38,19 @@ jobs: timeout-minutes: 30 strategy: matrix: - api-level: [23, 26, 29] + api-level: [24, 26] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Copy CI gradle.properties run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 17 distribution: 'zulu' @@ -53,7 +58,7 @@ jobs: - name: Generate cache key run: ./scripts/checksum.sh $SAMPLE_PATH checksum.txt - - uses: actions/cache@v5 + - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: | ~/.gradle/caches/modules-* @@ -62,7 +67,7 @@ jobs: key: gradle-${{ hashFiles('checksum.txt') }} - name: Run instrumentation tests - uses: reactivecircus/android-emulator-runner@v2 + uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0 with: api-level: ${{ matrix.api-level }} arch: x86 @@ -72,7 +77,7 @@ jobs: - name: Upload test reports if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: test-reports-reply-${{ matrix.api-level }} path: ${{ env.SAMPLE_PATH }}/app/build/reports diff --git a/.github/workflows/build-sample.yml b/.github/workflows/build-sample.yml index 9fb85442dc..56dbef41b5 100644 --- a/.github/workflows/build-sample.yml +++ b/.github/workflows/build-sample.yml @@ -25,6 +25,10 @@ on: concurrency: group: ${{ inputs.name }}-build-${{ github.ref }} cancel-in-progress: true + +permissions: + contents: read + env: compose_store_password: ${{ secrets.compose_store_password }} compose_key_alias: ${{ secrets.compose_key_alias }} @@ -35,17 +39,18 @@ jobs: timeout-minutes: 30 steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: # https://github.com/diffplug/spotless/issues/710 # Check out full history for Spotless to ensure ratchetFrom can find the ratchet version fetch-depth: 0 + persist-credentials: false - name: Copy CI gradle.properties run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 17 distribution: 'zulu' @@ -55,7 +60,7 @@ jobs: env: INPUTS_PATH: ${{ inputs.path }} - - uses: actions/cache@v5 + - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: | ~/.gradle/caches/modules-* @@ -84,14 +89,14 @@ jobs: run: ./gradlew testDebug --stacktrace - name: Upload build outputs (APKs) - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: build-outputs path: ${{ inputs.path }}/${{ inputs.module }}/build/outputs - name: Upload build reports if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: build-reports path: ${{ inputs.path }}/${{ inputs.module }}/build/reports diff --git a/.github/workflows/default-check.yml b/.github/workflows/default-check.yml index 7d524a4da7..c96635b08b 100644 --- a/.github/workflows/default-check.yml +++ b/.github/workflows/default-check.yml @@ -20,13 +20,18 @@ on: - 'Jetsnack/**' - 'Reply/**' +permissions: + contents: read + jobs: build: name: build runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Run a simple check run: echo "Running a simple check on files outside sample directories" diff --git a/.github/workflows/update_deps.yml b/.github/workflows/update_deps.yml index f2c8a0f713..1834f8663b 100644 --- a/.github/workflows/update_deps.yml +++ b/.github/workflows/update_deps.yml @@ -2,6 +2,11 @@ name: Update Versions / Dependencies on: workflow_dispatch: + +permissions: + contents: read + pull-requests: write + env: compose_store_password: ${{ secrets.COMPOSE_STORE_PASSWORD }} compose_key_alias: ${{ secrets.COMPOSE_KEY_ALIAS }} @@ -10,11 +15,13 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Copy CI gradle.properties run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties - name: set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 17 distribution: 'zulu' @@ -24,7 +31,7 @@ jobs: run: ./scripts/updateDeps.sh - name: Create pull request id: cpr - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.PAT }} commit-message: 🤖 Update Dependencies