Merge branch 'develop-v2' into v2/feature/rahullohra/build-on-sdk-37

# Conflicts:
#	.github/workflows/android.yml
#	.github/workflows/app-distribute.yml
#	.github/workflows/e2e-build.yml
#	.github/workflows/e2e-test-cron.yml
#	.github/workflows/e2e-test.yml
#	.github/workflows/internal-app-distribute.yml
#	gradle.properties
#	stream-video-android-core/src/main/kotlin/io/getstream/video/android/core/notifications/internal/receivers/GenericCallActionBroadcastReceiver.kt

Author: rahul-lohra

.github/workflows/android.yml

@@ -18,5 +18,13 @@ concurrency:
 
 jobs:
   base-android-ci:
+    permissions:
+      contents: read
+      pull-requests: read
     uses: GetStream/stream-build-conventions-android/.github/workflows/android-ci.yml@feature/rahullohra/build-on-sdk-37
-    secrets: inherit
+    secrets:
+      BUILD_CACHE_AWS_REGION: ${{ secrets.BUILD_CACHE_AWS_REGION }}
+      BUILD_CACHE_AWS_BUCKET: ${{ secrets.BUILD_CACHE_AWS_BUCKET }}
+      BUILD_CACHE_AWS_ACCESS_KEY_ID: ${{ secrets.BUILD_CACHE_AWS_ACCESS_KEY_ID }}
+      BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }}
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/app-distribute.yml

@@ -8,20 +8,28 @@ on:
 
 jobs:
   build_dogfooding_sample_app:
+    permissions:
+      actions: write
+      contents: read
     name: Build and Distribute Dogfooding Android
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
-      - uses: GetStream/android-ci-actions/actions/setup-java@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b
         with:
           java-version: '21'
       - name: Prepare environment
+        env:
+          ENV_PROPERTIES: ${{ secrets.ENV_PROPERTIES }}
+          PASSPHRASE: ${{ secrets.PASSPHRASE }}
+          RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }}
+          RELEASE_KEYSTORE_PROPERTIES: ${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}
         run: |
-          echo "${{ secrets.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc
-          gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore
-          echo "${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc
-          gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties
-          echo "${{ secrets.ENV_PROPERTIES }}" > .env.properties
+          echo "${{ env.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc
+          gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore
+          echo "${{ env.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc
+          gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties
+          echo "${{ env.ENV_PROPERTIES }}" > .env.properties
       - name: Assemble
         run: bash ./gradlew :demo-app:assembleRelease --stacktrace
       - name: Upload APK
@@ -30,7 +38,7 @@ jobs:
           name: demo-app-release
           path: demo-app/build/outputs/apk/demo-app/release/
       - name: Upload artifact to Firebase App Distribution
-        uses: wzieba/Firebase-Distribution-Github-Action@v1.7.1
+        uses: wzieba/Firebase-Distribution-Github-Action@bd494989dd4bec0343f78adee87fe66e48279ad6
         with:
           appId: ${{secrets.FIREBASE_DOGFOODING_SAMPLE_APP_ID}}
           serviceCredentialsFileContent: ${{ secrets.CREDENTIAL_FILE_CONTENT }}

.github/workflows/e2e-build.yml

@@ -11,15 +11,18 @@ env:
 
 jobs:
   build:
+    permissions:
+      actions: write
+      contents: read
     name: compose apks
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
-      - uses: GetStream/android-ci-actions/actions/setup-java@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b
         with:
           java-version: '21'
-      - uses: GetStream/android-ci-actions/actions/enable-kvm@main
-      - uses: GetStream/android-ci-actions/actions/setup-ruby@main
+      - uses: GetStream/android-ci-actions/actions/enable-kvm@cb46e4f44d105a68738bfd2a1cfd156bb768665b
+      - uses: GetStream/android-ci-actions/actions/setup-ruby@cb46e4f44d105a68738bfd2a1cfd156bb768665b
       - uses: GetStream/android-ci-actions/actions/gradle-cache@main
       - name: Build apks
         run: bundle exec fastlane build_e2e_test

.github/workflows/e2e-test-cron.yml

@@ -20,10 +20,15 @@ env:
 
 jobs:
   build-compose-apks:
+    permissions:
+      actions: write
+      contents: read
     name: Build
     uses: ./.github/workflows/e2e-build.yml
-
   run-compose-tests-nightly:
+    permissions:
+      actions: write
+      contents: read
     name: Test compose
     runs-on: ubuntu-24.04
     needs: build-compose-apks
@@ -40,22 +45,22 @@ jobs:
     env:
       ANDROID_API_LEVEL: ${{ matrix.android_api_level }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: actions/download-artifact@v8.0.1
         continue-on-error: true
         with:
           name: apks
-      - uses: GetStream/android-ci-actions/actions/setup-java@main
+      - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b
         with:
           java-version: '21'
-      - uses: GetStream/android-ci-actions/actions/enable-kvm@main
-      - uses: GetStream/android-ci-actions/actions/setup-ruby@main
-      - uses: GetStream/android-ci-actions/actions/allure-launch@main
+      - uses: GetStream/android-ci-actions/actions/enable-kvm@cb46e4f44d105a68738bfd2a1cfd156bb768665b
+      - uses: GetStream/android-ci-actions/actions/setup-ruby@cb46e4f44d105a68738bfd2a1cfd156bb768665b
+      - uses: GetStream/android-ci-actions/actions/allure-launch@cb46e4f44d105a68738bfd2a1cfd156bb768665b
         with:
           allure-token: ${{ secrets.ALLURE_TOKEN }}
           cron: true
       - name: Run tests
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d
         timeout-minutes: 120
         with:
           api-level: ${{ env.ANDROID_API_LEVEL }}
@@ -86,14 +91,16 @@ jobs:
             fastlane/recordings/*
             fastlane/video-buddy-server.log
             fastlane/video-buddy-console.log
-
   slack:
+    permissions:
+      actions: write
+      contents: read
     name: Slack Report
     runs-on: ubuntu-latest
     needs: [build-compose-apks, run-compose-tests-nightly]
     if: failure() && github.event_name == 'schedule'
     steps:
-      - uses: 8398a7/action-slack@v3
+      - uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e
         with:
           status: cancelled
           text: "You shall not pass!"

.github/workflows/e2e-test.yml

@@ -19,25 +19,35 @@ env:
 
 jobs:
   build-compose-apks:
+    permissions:
+      actions: write
+      contents: read
+      pull-requests: read
     name: Build
     uses: ./.github/workflows/e2e-build.yml
     secrets: inherit
-
   allure_testops_launch:
+    permissions:
+      actions: write
+      contents: read
+      pull-requests: read
     name: Launch Allure TestOps
     runs-on: ubuntu-24.04
     needs: build-compose-apks
     outputs:
       launch_id: ${{ env.LAUNCH_ID }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: GetStream/android-ci-actions/actions/setup-ruby@main
-      - uses: GetStream/android-ci-actions/actions/allure-launch@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: GetStream/android-ci-actions/actions/setup-ruby@cb46e4f44d105a68738bfd2a1cfd156bb768665b
+      - uses: GetStream/android-ci-actions/actions/allure-launch@cb46e4f44d105a68738bfd2a1cfd156bb768665b
         if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
         with:
           allure-token: ${{ secrets.ALLURE_TOKEN }}
-
   run-compose-tests:
+    permissions:
+      actions: write
+      contents: read
+      pull-requests: read
     name: Test compose
     runs-on: ubuntu-24.04
     needs:
@@ -54,18 +64,18 @@ jobs:
       ANDROID_API_LEVEL: 34
       LAUNCH_ID: ${{ needs.allure_testops_launch.outputs.launch_id }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: actions/download-artifact@v8.0.1
         continue-on-error: true
         with:
           name: apks
-      - uses: GetStream/android-ci-actions/actions/setup-java@main
+      - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b
         with:
           java-version: '21'
-      - uses: GetStream/android-ci-actions/actions/enable-kvm@main
-      - uses: GetStream/android-ci-actions/actions/setup-ruby@main
+      - uses: GetStream/android-ci-actions/actions/enable-kvm@cb46e4f44d105a68738bfd2a1cfd156bb768665b
+      - uses: GetStream/android-ci-actions/actions/setup-ruby@cb46e4f44d105a68738bfd2a1cfd156bb768665b
       - name: Run tests
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d
         timeout-minutes: 45
         with:
           api-level: ${{ env.ANDROID_API_LEVEL }}

.github/workflows/internal-app-distribute.yml

@@ -16,21 +16,29 @@ env:
 
 jobs:
   distribute_stream_video_calls_to_google_play:
+    permissions:
+      contents: read
     name: Distribute Stream Video Calls to Google Play
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
-      - uses: GetStream/android-ci-actions/actions/setup-java@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b
         with:
           java-version: '21'
       - name: Prepare environment
+        env:
+          ENV_PROPERTIES: ${{ secrets.ENV_PROPERTIES }}
+          PASSPHRASE: ${{ secrets.PASSPHRASE }}
+          RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }}
+          RELEASE_KEYSTORE_PROPERTIES: ${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}
+          SERVICE_ACCOUNT_CREDENTIALS: ${{ secrets.SERVICE_ACCOUNT_CREDENTIALS }}
         run: |
-          echo "${{ secrets.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc
-          gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore
-          echo "${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc
-          gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties
-          echo "${{ secrets.SERVICE_ACCOUNT_CREDENTIALS }}" > .sign/service-account-credentials.json.asc
-          gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/service-account-credentials.json.asc > .sign/service-account-credentials.json
-          echo "${{ secrets.ENV_PROPERTIES }}" > .env.properties
+          echo "${{ env.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc
+          gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore
+          echo "${{ env.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc
+          gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties
+          echo "${{ env.SERVICE_ACCOUNT_CREDENTIALS }}" > .sign/service-account-credentials.json.asc
+          gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/service-account-credentials.json.asc > .sign/service-account-credentials.json
+          echo "${{ env.ENV_PROPERTIES }}" > .env.properties
       - name: Publish Bundle
         run: bash ./gradlew publishBundle --stacktrace

.github/workflows/no-response.yml

@@ -9,6 +9,10 @@ on:
 
 jobs:
   noResponse:
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
     runs-on: ubuntu-22.04
     steps:
       - uses: lee-dohm/no-response@v0.5.0

.github/workflows/publish-new-version.yml

@@ -19,6 +19,8 @@ concurrency:
 
 jobs:
   pre_release_check:
+    permissions:
+      contents: read
     name: Pre release check
     runs-on: ubuntu-24.04
     environment: 'publish'
@@ -30,7 +32,7 @@ jobs:
     permissions:
       contents: write
     needs: pre_release_check
-    uses: GetStream/stream-build-conventions-android/.github/workflows/release.yml@v0.13.1
+    uses: GetStream/stream-build-conventions-android/.github/workflows/release.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73
     with:
       bump: ${{ inputs.bump }}
     secrets:

.github/workflows/sdk-size-updates.yml

@@ -13,7 +13,9 @@ concurrency:
 
 jobs:
   update-sdk-sizes:
-    uses: GetStream/stream-build-conventions-android/.github/workflows/sdk-size-updates.yml@v0.13.1
+    permissions:
+      contents: read
+    uses: GetStream/stream-build-conventions-android/.github/workflows/sdk-size-updates.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73
     with:
       modules: "stream-video-android-core stream-video-android-ui-xml stream-video-android-ui-compose"
       metrics-project: "stream-video-android-metrics"

CHANGELOG.md

@@ -12,6 +12,7 @@
 
 ## stream-video-android
 ### 🐞 Fixed
+Fix `NullPointerException` logged from `SortedParticipantsState.init` on every `Call` construction. The internal sort coroutine read `Call.events` before the field was initialized, racing against the rest of `Call`'s constructor on production dispatchers. The error was captured by the call scope's exception handler — calls continued to work — but the call-event-driven resort path was effectively dead.
 
 ### ⬆️ Improved
 
@@ -23,13 +24,18 @@
 
 ## stream-video-android-ui-compose
 ### 🐞 Fixed
+Fix R8/minified release builds failing with `Missing class io.getstream.video.android.mock.StreamPreviewDataUtils` (and related preview-data classes). All `@Preview` composables were moved out of the published artifact into a `debug`-only source set, so the `stream-video-android-previewdata` utilities are no longer referenced from release code. Consumers no longer need to add the preview module or extra ProGuard rules. Fixes [#1448](https://github.com/GetStream/stream-video-android/issues/1448).
+Declare `kotlinx-datetime` as an explicit dependency so the livestream countdown UI no longer relies on a transitive dependency, fixing `Missing class kotlinx.datetime.*` R8 errors.
 On CallContent make sure to pass onBackPressed to CallAppBar in order to make the back button work.
 
 ### ⬆️ Improved
 
 ### ✅ Added
+Add `participantLabelContent` slot to `CallLobby` so the lobby participant label can be hidden (`{}`) or fully customized. Brings the Compose API in line with React's `VideoPreview` slot overrides.
+Add `videoPreviewModifier` parameter to `CallLobby` so callers can override the size, shape, padding, and background of the local video preview box. Defaults preserve the previous responsive height + 12dp rounded corner clip, matching iOS (parent-driven sizing in `GeometryReader`) and React (`className`-driven sizing on `VideoPreview`).
 
 ### ⚠️ Changed
+Deprecate the `CallLobby` overload that takes `labelPosition: Alignment`. Migrate to the new `participantLabelContent` slot; pass `{}` to hide the label or supply a composable to customize content and positioning.
 
 ### ❌ Removed