From 571bebceac6b2f20046c1219462f55abdf715a13 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ros=C3=A1rio=20P=2E=20Fernandes?= Date: Tue, 21 Jul 2026 17:50:26 +0100 Subject: [PATCH 1/4] ci: actions/checkout@v5, actions/setup-java@v5, gradle/actions/setup-gradle@v6 --- .github/workflows/android.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index d402382fb5..9fcb13f3a2 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -13,9 +13,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 - name: Set up JDK 17 - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 17 @@ -24,7 +24,7 @@ jobs: with: node-version: 24 - name: Setup Gradle - uses: gradle/gradle-build-action@v2 + uses: gradle/actions/setup-gradle@v6 - name: Check Snippets run: python scripts/checksnippets.py - name: Copy mock google_services.json @@ -34,4 +34,4 @@ jobs: if: github.event_name == 'pull_request' - name: Build with Gradle (Push) run: ./gradlew clean ktlint assemble - if: github.event_name != 'pull_request' \ No newline at end of file + if: github.event_name != 'pull_request' From e398d2eb9d0b01d80c1ed797950c5538447dc156 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ros=C3=A1rio=20P=2E=20Fernandes?= Date: Tue, 21 Jul 2026 18:14:29 +0100 Subject: [PATCH 2/4] pin versions to specific commits --- .github/workflows/android.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index 9fcb13f3a2..8f065be148 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -13,18 +13,18 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: 'zulu' java-version: 17 - name: Install Node to use the Firebase CLI - uses: actions/setup-node@v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v6 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 - name: Check Snippets run: python scripts/checksnippets.py - name: Copy mock google_services.json From ff63707cc51bbbbc6c566039f2b543eb1f3b07cb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ros=C3=A1rio=20P=2E=20Fernandes?= Date: Tue, 21 Jul 2026 18:16:02 +0100 Subject: [PATCH 3/4] persist-credentials: false --- .github/workflows/android.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index 8f065be148..9c199fc14f 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -14,6 +14,8 @@ jobs: timeout-minutes: 30 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up JDK 17 uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: From dba0e822af27bde579983af515112f6011cace55 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ros=C3=A1rio=20P=2E=20Fernandes?= Date: Tue, 21 Jul 2026 18:25:38 +0100 Subject: [PATCH 4/4] fix excessive permissions --- .github/workflows/android.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index 9c199fc14f..33dbed4c16 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -4,6 +4,9 @@ on: pull_request: push: +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true