Fix YAML files and pinned versions

.github/workflows/JetLagged.yaml

@@ -13,6 +13,9 @@ on:
       - 'JetLagged/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   SAMPLE_PATH: JetLagged
   compose_store_password: ${{ secrets.COMPOSE_STORE_PASSWORD }}
@@ -35,25 +38,27 @@ jobs:
     timeout-minutes: 30
     strategy:
       matrix:
-        api-level: [23, 26, 29]
+        api-level: [24, 26]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: 17
           distribution: 'zulu'
 
       - name: Generate cache key
         run: ./scripts/checksum.sh $SAMPLE_PATH checksum.txt
 
-      - uses: actions/cache@v5
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ~/.gradle/caches/modules-*
@@ -62,7 +67,7 @@ jobs:
           key: gradle-${{ hashFiles('checksum.txt') }}
 
       - name: Run instrumentation tests
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
         with:
           api-level: ${{ matrix.api-level }}
           arch: x86
@@ -72,7 +77,7 @@ jobs:
 
       - name: Upload test reports
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: test-reports-jetlagged-${{ matrix.api-level }}
           path: ${{ env.SAMPLE_PATH }}/app/build/reports

.github/workflows/JetNews.yaml

@@ -13,6 +13,9 @@ on:
       - 'JetNews/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   SAMPLE_PATH: JetNews
   compose_store_password: ${{ secrets.compose_store_password }}
@@ -35,11 +38,13 @@ jobs:
     timeout-minutes: 30
     strategy:
       matrix:
-        api-level: [23, 26, 29]
+        api-level: [24, 26]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
       - name: Enable KVM group perms
         run: |
             echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
@@ -49,23 +54,23 @@ jobs:
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: 17
           distribution: 'zulu'
 
       - name: Generate cache key
         run: ./scripts/checksum.sh $SAMPLE_PATH checksum.txt
 
-      - uses: actions/cache@v5
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ~/.gradle/caches/modules-*
             ~/.gradle/caches/jars-*
             ~/.gradle/caches/build-cache-*
           key: gradle-${{ hashFiles('checksum.txt') }}
       - name: Run instrumentation tests
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
         with:
           api-level: ${{ matrix.api-level }}
           arch: x86
@@ -75,7 +80,7 @@ jobs:
 
       - name: Upload test reports
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: test-reports-jetnews-${{ matrix.api-level }}
           path: ${{ env.SAMPLE_PATH }}/app/build/reports/androidTests

.github/workflows/Jetcaster.yaml

@@ -13,6 +13,9 @@ on:
       - 'Jetcaster/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: ./.github/workflows/build-sample.yml

.github/workflows/Jetchat.yaml

@@ -13,6 +13,9 @@ on:
       - 'Jetchat/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   SAMPLE_PATH: Jetchat
   compose_store_password: ${{ secrets.compose_store_password }}
@@ -34,25 +37,27 @@ jobs:
     timeout-minutes: 30
     strategy:
       matrix:
-        api-level: [23, 26, 29]
+        api-level: [24, 26]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: 17
           distribution: 'zulu'
 
       - name: Generate cache key
         run: ./scripts/checksum.sh $SAMPLE_PATH checksum.txt
 
-      - uses: actions/cache@v5
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ~/.gradle/caches/modules-*
@@ -61,7 +66,7 @@ jobs:
           key: gradle-${{ hashFiles('checksum.txt') }}
 
       - name: Run instrumentation tests
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
         with:
           api-level: ${{ matrix.api-level }}
           arch: x86
@@ -71,7 +76,7 @@ jobs:
 
       - name: Upload test reports
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: test-reports-jetchat-${{ matrix.api-level }}
           path: ${{ env.SAMPLE_PATH }}/app/build/reports

.github/workflows/Jetsnack.yaml

@@ -13,6 +13,9 @@ on:
       - 'Jetsnack/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: ./.github/workflows/build-sample.yml

.github/workflows/Release.yml

@@ -4,6 +4,10 @@ on:
   push:
     tags:
     - 'v*'
+
+permissions:
+  contents: read
+
 env:
   compose_store_password: ${{ secrets.COMPOSE_STORE_PASSWORD }}
   compose_key_alias: ${{ secrets.COMPOSE_KEY_ALIAS }}
@@ -15,13 +19,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6   
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: 17
           distribution: 'zulu'

.github/workflows/Reply.yaml

@@ -13,6 +13,9 @@ on:
       - 'Reply/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   SAMPLE_PATH: Reply
   compose_store_password: ${{ secrets.COMPOSE_STORE_PASSWORD }}
@@ -35,25 +38,27 @@ jobs:
     timeout-minutes: 30
     strategy:
       matrix:
-        api-level: [23, 26, 29]
+        api-level: [24, 26]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: 17
           distribution: 'zulu'
 
       - name: Generate cache key
         run: ./scripts/checksum.sh $SAMPLE_PATH checksum.txt
 
-      - uses: actions/cache@v5
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ~/.gradle/caches/modules-*
@@ -62,7 +67,7 @@ jobs:
           key: gradle-${{ hashFiles('checksum.txt') }}
 
       - name: Run instrumentation tests
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
         with:
           api-level: ${{ matrix.api-level }}
           arch: x86
@@ -72,7 +77,7 @@ jobs:
 
       - name: Upload test reports
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: test-reports-reply-${{ matrix.api-level }}
           path: ${{ env.SAMPLE_PATH }}/app/build/reports

.github/workflows/build-sample.yml

@@ -25,6 +25,10 @@ on:
 concurrency:
   group: ${{ inputs.name }}-build-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
+
 env:
   compose_store_password: ${{ secrets.compose_store_password }}
   compose_key_alias: ${{ secrets.compose_key_alias }}
@@ -35,17 +39,18 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # https://github.com/diffplug/spotless/issues/710
           # Check out full history for Spotless to ensure ratchetFrom can find the ratchet version
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: 17
           distribution: 'zulu'
@@ -55,7 +60,7 @@ jobs:
         env:
           INPUTS_PATH: ${{ inputs.path }}
 
-      - uses: actions/cache@v5
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ~/.gradle/caches/modules-*
@@ -84,14 +89,14 @@ jobs:
         run: ./gradlew testDebug --stacktrace
 
       - name: Upload build outputs (APKs)
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: build-outputs
           path: ${{ inputs.path }}/${{ inputs.module }}/build/outputs
 
       - name: Upload build reports
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: build-reports
           path: ${{ inputs.path }}/${{ inputs.module }}/build/reports

.github/workflows/default-check.yml

@@ -20,13 +20,18 @@ on:
       - 'Jetsnack/**'
       - 'Reply/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: build
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Run a simple check
         run: echo "Running a simple check on files outside sample directories"