build(deps): update dependencies, fix zizmor findings, and restore JaCoCo coverage - #954
Merged
Conversation
Contributor
Code Coverage
|
Bump AGP, Material, ConstraintLayout, and the Maven Publish plugin to
their latest stable releases. AGP 9.3.1 requires Gradle >= 9.5.0, so
the wrapper is regenerated (via `gradlew wrapper`) to 9.6.1.
The `screenshot` version (com.android.compose.screenshot /
screenshot-validation-api) is left pinned at 0.0.1-alpha14: bumping to
the latest 0.0.1-alpha16 breaks the `screenshotTests {}` DSL in
maps-app/build.gradle.kts (unresolved reference), since this is an
experimental, alpha-only AGP feature with an unstable API across
alpha releases. Reproduced and isolated locally - reverting this one
version while keeping AGP 9.3.1 fixes the build. Needs a dedicated
migration, tracked separately.
zizmor (required check) fails a workflow on two mandatory finding
types plus its Medium-severity excessive-permissions check:
- unpinned-uses: pin every third-party action across all 11 workflow
files to a full commit SHA (trailing comment records the resolved
version) instead of a mutable tag.
- template-injection: release-rc.yml interpolated the workflow_dispatch
`branch` input directly into a `run:` shell script
(`git push origin "${{ inputs.branch }}"`), a shell injection vector.
Routed it through a BRANCH env var, matching how VERSION is already
handled in the same job.
- excessive-permissions: docs.yml, lint-report.yml, publish.yml,
test.yml, and update-skill.yml had no `permissions:` block, so they
inherited the broad default GITHUB_TOKEN scope even though none of
their steps need it (PR/release creation there uses a separate PAT).
Added least-privilege blocks; lint-report.yml additionally needs
security-events: write for its SARIF uploads.
Also bumped actions/setup-java v4 -> v5 (auto-fix.yml, to match every
other workflow), actions/setup-python v6 -> v7,
googleapis/release-please-action v4 -> v5, and madrapps/jacoco-report
v1.7.2 -> v1.8.0.
The hand-rolled `jacocoTestReport` task in PublishingConventionPlugin pointed classDirectories at build/tmp/kotlin-classes/debug - the legacy Kotlin Gradle Plugin output path. AGP 9's built-in Kotlin compiler now outputs to intermediates/built_in_kotlinc/ instead, so that directory no longer exists and every jacocoTestReport was silently producing an empty report (only a <sessioninfo>, zero <package>/<class> entries), for every module using this convention plugin (maps-compose, maps-compose-utils, maps-compose-widgets). Verified against maps-compose-utils (the only library module with unit tests): report went from 247 bytes / no classes to 87KB with 36 real classes and non-zero counters. Also included the javac output dir for parity with any future Java sources.
The emulator-runner pin used a tag OBJECT sha (c9c93e6b...) instead of the commit it points to - v2 and v2.38.0 are both annotated tags that peel to the same commit (a421e4385516...), which is what the previous @v2 reference actually resolved to. zizmor's hash-pin check correctly flagged the mismatch. Also fixes a second zizmor template-injection finding: "Get the Coverage info" interpolated ${{ steps.jacoco.outputs.* }} directly into a run: echo, on two lines (hence "2 findings" from a single job). Routed both through env vars, same pattern as the other injection fixes.
kikoso
force-pushed
the
chore/update-dependencies
branch
from
August 6, 2026 14:32
7e48d2a to
d8a890b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gradle/libs.versions.tomlto their latest stable releases; regenerate the Gradle wrapper to 9.6.1 (AGP 9.3.1 requires Gradle >= 9.5.0).screenshot(AGP's experimental screenshot-testing plugin) is intentionally left at0.0.1-alpha14— bumping to0.0.1-alpha16breaks thescreenshotTests {}DSL inmaps-app/build.gradle.kts. Isolated and reproduced locally; needs a dedicated migration.release-rc.yml(workflow_dispatchbranch input interpolated directly into arun:script), and add least-privilegepermissions:blocks to the 5 workflows that had none.setup-javav4→v5,setup-pythonv6→v7,release-please-actionv4→v5,jacoco-reportv1.7.2→v1.8.0.PublishingConventionPlugin's hand-rolledjacocoTestReporttask pointedclassDirectoriesat the legacytmp/kotlin-classes/debugpath. AGP 9's built-in Kotlin compiler now outputs tointermediates/built_in_kotlinc/, so every report was silently empty (0 classes) for every module using this plugin. Verified fix againstmaps-compose-utils(247 bytes / 0 classes → 87KB / 36 classes with real, non-zero counters).Test plan
./gradlew build jacocoTestReport -x :maps-app:generateDebugScreenshotTestConfig -x :maps-app:generateReleaseScreenshotTestConfig --stacktrace(matchestest.yml) succeeds./gradlew :maps-app:validateDebugScreenshotTest(matchestest.yml) succeedsjacocoTestReportformaps-compose-utilsnow produces a real report with non-zero coverage counters