Skip to content

Commit 385d5ee

Browse files
riggarooriggaroo
authored
Fix YAML files and pinned versions (#1714)
2 parents 4c1fe75 + ea796bd commit 385d5ee

10 files changed

Lines changed: 84 additions & 35 deletions

File tree

‎.github/workflows/JetLagged.yaml‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ on:
1313
- 'JetLagged/**'
1414
workflow_dispatch:
1515

16+
permissions:
17+
contents: read
18+
1619
env:
1720
SAMPLE_PATH: JetLagged
1821
compose_store_password: ${{ secrets.COMPOSE_STORE_PASSWORD }}
@@ -35,25 +38,27 @@ jobs:
3538
timeout-minutes: 30
3639
strategy:
3740
matrix:
38-
api-level: [23, 26, 29]
41+
api-level: [24, 26]
3942

4043
steps:
4144
- name: Checkout
42-
uses: actions/checkout@v6
45+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
46+
with:
47+
persist-credentials: false
4348

4449
- name: Copy CI gradle.properties
4550
run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
4651

4752
- name: Set up JDK 17
48-
uses: actions/setup-java@v5
53+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
4954
with:
5055
java-version: 17
5156
distribution: 'zulu'
5257

5358
- name: Generate cache key
5459
run: ./scripts/checksum.sh $SAMPLE_PATH checksum.txt
5560

56-
- uses: actions/cache@v5
61+
- uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
5762
with:
5863
path: |
5964
~/.gradle/caches/modules-*
@@ -62,7 +67,7 @@ jobs:
6267
key: gradle-${{ hashFiles('checksum.txt') }}
6368

6469
- name: Run instrumentation tests
65-
uses: reactivecircus/android-emulator-runner@v2
70+
uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
6671
with:
6772
api-level: ${{ matrix.api-level }}
6873
arch: x86
@@ -72,7 +77,7 @@ jobs:
7277

7378
- name: Upload test reports
7479
if: always()
75-
uses: actions/upload-artifact@v6
80+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
7681
with:
7782
name: test-reports-jetlagged-${{ matrix.api-level }}
7883
path: ${{ env.SAMPLE_PATH }}/app/build/reports

‎.github/workflows/JetNews.yaml‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ on:
1313
- 'JetNews/**'
1414
workflow_dispatch:
1515

16+
permissions:
17+
contents: read
18+
1619
env:
1720
SAMPLE_PATH: JetNews
1821
compose_store_password: ${{ secrets.compose_store_password }}
@@ -35,11 +38,13 @@ jobs:
3538
timeout-minutes: 30
3639
strategy:
3740
matrix:
38-
api-level: [23, 26, 29]
41+
api-level: [24, 26]
3942

4043
steps:
4144
- name: Checkout
42-
uses: actions/checkout@v6
45+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
46+
with:
47+
persist-credentials: false
4348
- name: Enable KVM group perms
4449
run: |
4550
echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
@@ -49,23 +54,23 @@ jobs:
4954
run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
5055

5156
- name: Set up JDK 17
52-
uses: actions/setup-java@v5
57+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
5358
with:
5459
java-version: 17
5560
distribution: 'zulu'
5661

5762
- name: Generate cache key
5863
run: ./scripts/checksum.sh $SAMPLE_PATH checksum.txt
5964

60-
- uses: actions/cache@v5
65+
- uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
6166
with:
6267
path: |
6368
~/.gradle/caches/modules-*
6469
~/.gradle/caches/jars-*
6570
~/.gradle/caches/build-cache-*
6671
key: gradle-${{ hashFiles('checksum.txt') }}
6772
- name: Run instrumentation tests
68-
uses: reactivecircus/android-emulator-runner@v2
73+
uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
6974
with:
7075
api-level: ${{ matrix.api-level }}
7176
arch: x86
@@ -75,7 +80,7 @@ jobs:
7580

7681
- name: Upload test reports
7782
if: always()
78-
uses: actions/upload-artifact@v6
83+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
7984
with:
8085
name: test-reports-jetnews-${{ matrix.api-level }}
8186
path: ${{ env.SAMPLE_PATH }}/app/build/reports/androidTests

‎.github/workflows/Jetcaster.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ on:
1313
- 'Jetcaster/**'
1414
workflow_dispatch:
1515

16+
permissions:
17+
contents: read
18+
1619
jobs:
1720
build:
1821
uses: ./.github/workflows/build-sample.yml

‎.github/workflows/Jetchat.yaml‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ on:
1313
- 'Jetchat/**'
1414
workflow_dispatch:
1515

16+
permissions:
17+
contents: read
18+
1619
env:
1720
SAMPLE_PATH: Jetchat
1821
compose_store_password: ${{ secrets.compose_store_password }}
@@ -34,25 +37,27 @@ jobs:
3437
timeout-minutes: 30
3538
strategy:
3639
matrix:
37-
api-level: [23, 26, 29]
40+
api-level: [24, 26]
3841

3942
steps:
4043
- name: Checkout
41-
uses: actions/checkout@v6
44+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
45+
with:
46+
persist-credentials: false
4247

4348
- name: Copy CI gradle.properties
4449
run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
4550

4651
- name: Set up JDK 17
47-
uses: actions/setup-java@v5
52+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
4853
with:
4954
java-version: 17
5055
distribution: 'zulu'
5156

5257
- name: Generate cache key
5358
run: ./scripts/checksum.sh $SAMPLE_PATH checksum.txt
5459

55-
- uses: actions/cache@v5
60+
- uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
5661
with:
5762
path: |
5863
~/.gradle/caches/modules-*
@@ -61,7 +66,7 @@ jobs:
6166
key: gradle-${{ hashFiles('checksum.txt') }}
6267

6368
- name: Run instrumentation tests
64-
uses: reactivecircus/android-emulator-runner@v2
69+
uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
6570
with:
6671
api-level: ${{ matrix.api-level }}
6772
arch: x86
@@ -71,7 +76,7 @@ jobs:
7176

7277
- name: Upload test reports
7378
if: always()
74-
uses: actions/upload-artifact@v6
79+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
7580
with:
7681
name: test-reports-jetchat-${{ matrix.api-level }}
7782
path: ${{ env.SAMPLE_PATH }}/app/build/reports

‎.github/workflows/Jetsnack.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ on:
1313
- 'Jetsnack/**'
1414
workflow_dispatch:
1515

16+
permissions:
17+
contents: read
18+
1619
jobs:
1720
build:
1821
uses: ./.github/workflows/build-sample.yml

‎.github/workflows/Release.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ on:
44
push:
55
tags:
66
- 'v*'
7+
8+
permissions:
9+
contents: read
10+
711
env:
812
compose_store_password: ${{ secrets.COMPOSE_STORE_PASSWORD }}
913
compose_key_alias: ${{ secrets.COMPOSE_KEY_ALIAS }}
@@ -15,13 +19,15 @@ jobs:
1519

1620
steps:
1721
- name: Checkout
18-
uses: actions/checkout@v6
22+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
23+
with:
24+
persist-credentials: false
1925

2026
- name: Copy CI gradle.properties
2127
run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
2228

2329
- name: Set up JDK 17
24-
uses: actions/setup-java@v5
30+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
2531
with:
2632
java-version: 17
2733
distribution: 'zulu'

‎.github/workflows/Reply.yaml‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ on:
1313
- 'Reply/**'
1414
workflow_dispatch:
1515

16+
permissions:
17+
contents: read
18+
1619
env:
1720
SAMPLE_PATH: Reply
1821
compose_store_password: ${{ secrets.COMPOSE_STORE_PASSWORD }}
@@ -35,25 +38,27 @@ jobs:
3538
timeout-minutes: 30
3639
strategy:
3740
matrix:
38-
api-level: [23, 26, 29]
41+
api-level: [24, 26]
3942

4043
steps:
4144
- name: Checkout
42-
uses: actions/checkout@v6
45+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
46+
with:
47+
persist-credentials: false
4348

4449
- name: Copy CI gradle.properties
4550
run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
4651

4752
- name: Set up JDK 17
48-
uses: actions/setup-java@v5
53+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
4954
with:
5055
java-version: 17
5156
distribution: 'zulu'
5257

5358
- name: Generate cache key
5459
run: ./scripts/checksum.sh $SAMPLE_PATH checksum.txt
5560

56-
- uses: actions/cache@v5
61+
- uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
5762
with:
5863
path: |
5964
~/.gradle/caches/modules-*
@@ -62,7 +67,7 @@ jobs:
6267
key: gradle-${{ hashFiles('checksum.txt') }}
6368

6469
- name: Run instrumentation tests
65-
uses: reactivecircus/android-emulator-runner@v2
70+
uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
6671
with:
6772
api-level: ${{ matrix.api-level }}
6873
arch: x86
@@ -72,7 +77,7 @@ jobs:
7277

7378
- name: Upload test reports
7479
if: always()
75-
uses: actions/upload-artifact@v6
80+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
7681
with:
7782
name: test-reports-reply-${{ matrix.api-level }}
7883
path: ${{ env.SAMPLE_PATH }}/app/build/reports

‎.github/workflows/build-sample.yml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ on:
2525
concurrency:
2626
group: ${{ inputs.name }}-build-${{ github.ref }}
2727
cancel-in-progress: true
28+
29+
permissions:
30+
contents: read
31+
2832
env:
2933
compose_store_password: ${{ secrets.compose_store_password }}
3034
compose_key_alias: ${{ secrets.compose_key_alias }}
@@ -35,17 +39,18 @@ jobs:
3539
timeout-minutes: 30
3640
steps:
3741
- name: Checkout
38-
uses: actions/checkout@v6
42+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
3943
with:
4044
# https://github.com/diffplug/spotless/issues/710
4145
# Check out full history for Spotless to ensure ratchetFrom can find the ratchet version
4246
fetch-depth: 0
47+
persist-credentials: false
4348

4449
- name: Copy CI gradle.properties
4550
run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
4651

4752
- name: Set up JDK 17
48-
uses: actions/setup-java@v5
53+
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
4954
with:
5055
java-version: 17
5156
distribution: 'zulu'
@@ -55,7 +60,7 @@ jobs:
5560
env:
5661
INPUTS_PATH: ${{ inputs.path }}
5762

58-
- uses: actions/cache@v5
63+
- uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
5964
with:
6065
path: |
6166
~/.gradle/caches/modules-*
@@ -84,14 +89,14 @@ jobs:
8489
run: ./gradlew testDebug --stacktrace
8590

8691
- name: Upload build outputs (APKs)
87-
uses: actions/upload-artifact@v6
92+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
8893
with:
8994
name: build-outputs
9095
path: ${{ inputs.path }}/${{ inputs.module }}/build/outputs
9196

9297
- name: Upload build reports
9398
if: always()
94-
uses: actions/upload-artifact@v6
99+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
95100
with:
96101
name: build-reports
97102
path: ${{ inputs.path }}/${{ inputs.module }}/build/reports

‎.github/workflows/default-check.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,18 @@ on:
2020
- 'Jetsnack/**'
2121
- 'Reply/**'
2222

23+
permissions:
24+
contents: read
25+
2326
jobs:
2427
build:
2528
name: build
2629
runs-on: ubuntu-latest
2730
steps:
2831
- name: Checkout
29-
uses: actions/checkout@v6
32+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
33+
with:
34+
persist-credentials: false
3035

3136
- name: Run a simple check
3237
run: echo "Running a simple check on files outside sample directories"

0 commit comments

Comments
 (0)