diff --git a/.github/workflows/apk-s3-distribute.yml b/.github/workflows/apk-s3-distribute.yml index 515651265db..92e0535e232 100644 --- a/.github/workflows/apk-s3-distribute.yml +++ b/.github/workflows/apk-s3-distribute.yml @@ -8,18 +8,25 @@ on: jobs: build_ui_components_sample_app: + permissions: + contents: read + id-token: write name: Build and push to S3 runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Prepare environment + env: + PASSPHRASE: ${{ secrets.PASSPHRASE }} + RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }} + RELEASE_KEYSTORE_PROPERTIES: ${{ secrets.RELEASE_KEYSTORE_PROPERTIES }} run: | git fetch --unshallow - echo "${{ secrets.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore - echo "${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties + echo "${{ env.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore + echo "${{ env.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties - name: Assemble run: ./gradlew :stream-chat-android-ui-components-sample:assembleDemoRelease --stacktrace - name: Configure AWS credentials diff --git a/.github/workflows/app-distribute-v7.yml b/.github/workflows/app-distribute-v7.yml index 1c5e516ba3a..aad910b0604 100644 --- a/.github/workflows/app-distribute-v7.yml +++ b/.github/workflows/app-distribute-v7.yml @@ -11,18 +11,24 @@ on: jobs: build_compose_sample_app: + permissions: + contents: read name: Build and Distribute Compose Sample App runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Prepare environment + env: + PASSPHRASE: ${{ secrets.PASSPHRASE }} + RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }} + RELEASE_KEYSTORE_PROPERTIES: ${{ secrets.RELEASE_KEYSTORE_PROPERTIES }} run: | git fetch --unshallow - echo "${{ secrets.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore - echo "${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties + echo "${{ env.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore + echo "${{ env.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties - name: Assemble run: ./gradlew :stream-chat-android-compose-sample:assembleRelease --stacktrace - name: Upload artifact to Firebase App Distribution diff --git a/.github/workflows/app-distribute.yml b/.github/workflows/app-distribute.yml index 2e5909a34a6..bcd449f9e3d 100644 --- a/.github/workflows/app-distribute.yml +++ b/.github/workflows/app-distribute.yml @@ -8,18 +8,25 @@ on: jobs: build_ui_components_sample_app: + permissions: + actions: write + contents: read name: Build and Distribute UI Components Sample App runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Prepare environment + env: + PASSPHRASE: ${{ secrets.PASSPHRASE }} + RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }} + RELEASE_KEYSTORE_PROPERTIES: ${{ secrets.RELEASE_KEYSTORE_PROPERTIES }} run: | git fetch --unshallow - echo "${{ secrets.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore - echo "${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties + echo "${{ env.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore + echo "${{ env.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties - name: Assemble run: bash ./gradlew :stream-chat-android-ui-components-sample:assembleDemoRelease --stacktrace - name: Upload APK @@ -34,20 +41,26 @@ jobs: serviceCredentialsFileContent: ${{ secrets.CREDENTIAL_FILE_CONTENT }} groups: stream-testers file: stream-chat-android-ui-components-sample/build/outputs/apk/demo/release/stream-chat-android-ui-components-sample-demo-release.apk - build_compose_sample_app: + permissions: + actions: write + contents: read name: Build and Distribute Compose Sample App runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Prepare environment + env: + PASSPHRASE: ${{ secrets.PASSPHRASE }} + RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }} + RELEASE_KEYSTORE_PROPERTIES: ${{ secrets.RELEASE_KEYSTORE_PROPERTIES }} run: | git fetch --unshallow - echo "${{ secrets.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore - echo "${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties + echo "${{ env.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore + echo "${{ env.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties - name: Assemble run: bash ./gradlew :stream-chat-android-compose-sample:assembleRelease --stacktrace - name: Upload APK diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 79976c31b31..effc6e670da 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -12,34 +12,41 @@ concurrency: jobs: debug_build: + permissions: + actions: write + contents: read name: Debug build runs-on: ubuntu-22.04 steps: - name: Check out code - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Build run: ./gradlew assembleDebug - release_build: + permissions: + actions: write + contents: read name: Release build runs-on: ubuntu-22.04 steps: - name: Check out code - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Build run: ./gradlew assembleRelease - tests: + permissions: + actions: write + contents: read name: Tests runs-on: ubuntu-22.04 steps: - name: Check out code - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: fetch-depth: 0 # fetch all history for sonar analysis - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Unit tests run: ./gradlew :testCoverage - name: Upload test results @@ -53,14 +60,16 @@ jobs: run: bundle exec fastlane run_sonar_analysis env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - size_check_xml: + permissions: + actions: write + contents: read name: Size Check XML runs-on: ubuntu-22.04 steps: - name: Check out code - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: build demo debug run: ./gradlew stream-chat-android-ui-components-sample:assembleDemoDebug - name: Upload artifact to Emerge @@ -69,14 +78,16 @@ jobs: artifact_path: ./stream-chat-android-ui-components-sample/build/outputs/apk/demo/debug/stream-chat-android-ui-components-sample-demo-debug.apk emerge_api_key: ${{ secrets.EMERGE_TOOLS_API_KEY }} build_type: debug - size_check_compose: + permissions: + actions: write + contents: read name: Size Check Compose runs-on: ubuntu-22.04 steps: - name: Check out code - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: build debug run: ./gradlew stream-chat-android-compose-sample:assembleDebug - name: Upload artifact to Emerge diff --git a/.github/workflows/clean-detekt-baseline.yaml b/.github/workflows/clean-detekt-baseline.yaml index 99e057ab6dd..5a3a6fe7030 100644 --- a/.github/workflows/clean-detekt-baseline.yaml +++ b/.github/workflows/clean-detekt-baseline.yaml @@ -7,14 +7,17 @@ on: jobs: clean_detekt_baseline_files: + permissions: + contents: read + pull-requests: write name: Clean Detekt Baseline Files runs-on: ubuntu-22.04 steps: - name: Check out code - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: token: ${{ secrets.STREAM_PUBLIC_BOT_TOKEN }} - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: tibdex/github-app-token@v2.1.0 id: generate-token with: diff --git a/.github/workflows/e2e-build.yml b/.github/workflows/e2e-build.yml index 8a26fdf5abd..fd29d80aea6 100644 --- a/.github/workflows/e2e-build.yml +++ b/.github/workflows/e2e-build.yml @@ -15,11 +15,14 @@ env: jobs: build: + permissions: + actions: write + contents: read name: ${{ inputs.app }} apks runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/enable-kvm@main - uses: GetStream/android-ci-actions/actions/setup-ruby@main - uses: GetStream/android-ci-actions/actions/gradle-cache@main diff --git a/.github/workflows/e2e-test-backend.yml b/.github/workflows/e2e-test-backend.yml index 10dfbda35bc..c12fdfb429f 100644 --- a/.github/workflows/e2e-test-backend.yml +++ b/.github/workflows/e2e-test-backend.yml @@ -12,13 +12,16 @@ env: jobs: test-backend-integration: + permissions: + actions: write + contents: read name: Test Backend Integration runs-on: ubuntu-24.04 env: ANDROID_API_LEVEL: 34 steps: - - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/enable-kvm@main - uses: GetStream/android-ci-actions/actions/setup-ruby@main - name: Run tests diff --git a/.github/workflows/e2e-test-cron.yml b/.github/workflows/e2e-test-cron.yml index 6ce5985b6a5..04e11dfb64c 100644 --- a/.github/workflows/e2e-test-cron.yml +++ b/.github/workflows/e2e-test-cron.yml @@ -26,12 +26,17 @@ env: jobs: build-compose-apks: + permissions: + actions: write + contents: read name: Build uses: ./.github/workflows/e2e-build.yml with: app: compose - run-compose-tests-nightly: + permissions: + actions: write + contents: read name: Test compose runs-on: ubuntu-24.04 needs: build-compose-apks @@ -48,12 +53,12 @@ jobs: env: ANDROID_API_LEVEL: ${{ matrix.android_api_level }} steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: actions/download-artifact@v8.0.1 continue-on-error: true with: name: apks - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/enable-kvm@main - uses: GetStream/android-ci-actions/actions/setup-ruby@main - uses: GetStream/android-ci-actions/actions/allure-launch@main @@ -89,8 +94,10 @@ jobs: with: name: logs_${{ env.ANDROID_API_LEVEL }} path: fastlane/stream-chat-test-mock-server/logs/* - slack: + permissions: + actions: write + contents: read name: Slack Report runs-on: ubuntu-latest needs: [build-compose-apks, run-compose-tests-nightly] diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml index af701effa21..9fcdd91e79a 100644 --- a/.github/workflows/e2e-test.yml +++ b/.github/workflows/e2e-test.yml @@ -25,27 +25,37 @@ env: jobs: build-compose-apks: + permissions: + actions: write + contents: read + pull-requests: read name: Build uses: ./.github/workflows/e2e-build.yml with: app: compose secrets: inherit - allure_testops_launch: + permissions: + actions: write + contents: read + pull-requests: read name: Launch Allure TestOps runs-on: ubuntu-24.04 needs: build-compose-apks outputs: launch_id: ${{ env.LAUNCH_ID }} steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-ruby@main - uses: GetStream/android-ci-actions/actions/allure-launch@main if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} with: allure-token: ${{ secrets.ALLURE_TOKEN }} - run-compose-tests: + permissions: + actions: write + contents: read + pull-requests: read name: Test compose runs-on: ubuntu-24.04 needs: @@ -62,12 +72,12 @@ jobs: ANDROID_API_LEVEL: 34 LAUNCH_ID: ${{ needs.allure_testops_launch.outputs.launch_id }} steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: actions/download-artifact@v8.0.1 continue-on-error: true with: name: apks - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/enable-kvm@main - uses: GetStream/android-ci-actions/actions/setup-ruby@main - name: Run tests diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml index 3bd72f76625..14f27c30aed 100644 --- a/.github/workflows/no-response.yml +++ b/.github/workflows/no-response.yml @@ -9,6 +9,10 @@ on: jobs: noResponse: + permissions: + contents: read + issues: write + pull-requests: read runs-on: ubuntu-22.04 steps: - uses: lee-dohm/no-response@v0.5.0 diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index c26f45e6a6f..43ad069543c 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -8,22 +8,34 @@ concurrency: jobs: base-android-ci: - uses: GetStream/stream-build-conventions-android/.github/workflows/android-ci.yml@v0.13.1 - secrets: inherit - + permissions: + contents: read + pull-requests: read + uses: GetStream/stream-build-conventions-android/.github/workflows/android-ci.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 + secrets: + BUILD_CACHE_AWS_REGION: ${{ secrets.BUILD_CACHE_AWS_REGION }} + BUILD_CACHE_AWS_BUCKET: ${{ secrets.BUILD_CACHE_AWS_BUCKET }} + BUILD_CACHE_AWS_ACCESS_KEY_ID: ${{ secrets.BUILD_CACHE_AWS_ACCESS_KEY_ID }} + BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} detekt: + permissions: + contents: read + pull-requests: read name: Detekt runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/stream-build-conventions-android/.github/actions/setup-gradle@v0.13.1 - name: Detekt run: ./gradlew detekt - rubocop: + permissions: + contents: read + pull-requests: read name: Rubocop runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-ruby@main - run: bundle exec fastlane rubocop diff --git a/.github/workflows/publish-new-version.yml b/.github/workflows/publish-new-version.yml index 23a00e9786a..d239c296263 100644 --- a/.github/workflows/publish-new-version.yml +++ b/.github/workflows/publish-new-version.yml @@ -25,6 +25,8 @@ concurrency: jobs: pre_release_check: + permissions: + contents: read name: Pre release check runs-on: ubuntu-24.04 environment: 'publish' @@ -36,7 +38,7 @@ jobs: permissions: contents: write needs: pre_release_check - uses: GetStream/stream-build-conventions-android/.github/workflows/release.yml@v0.13.1 + uses: GetStream/stream-build-conventions-android/.github/workflows/release.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 with: bump: ${{ inputs.bump }} suffix: ${{ inputs.suffix }} diff --git a/.github/workflows/sdk-size-updates.yml b/.github/workflows/sdk-size-updates.yml index 44ce33110dd..eabba3c7049 100644 --- a/.github/workflows/sdk-size-updates.yml +++ b/.github/workflows/sdk-size-updates.yml @@ -13,7 +13,9 @@ concurrency: jobs: update-sdk-sizes: - uses: GetStream/stream-build-conventions-android/.github/workflows/sdk-size-updates.yml@v0.13.1 + permissions: + contents: read + uses: GetStream/stream-build-conventions-android/.github/workflows/sdk-size-updates.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 with: modules: "stream-chat-android-client stream-chat-android-ui-components stream-chat-android-compose" metrics-project: "stream-chat-android-metrics" diff --git a/.github/workflows/snapshot-test.yaml b/.github/workflows/snapshot-test.yaml index ab20a10ce95..f973fae20de 100644 --- a/.github/workflows/snapshot-test.yaml +++ b/.github/workflows/snapshot-test.yaml @@ -17,12 +17,16 @@ env: jobs: run_snapshot_tests: + permissions: + actions: write + contents: read + pull-requests: write name: Run runs-on: ubuntu-24.04 steps: - name: Check out code - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/setup-ruby@main - uses: GetStream/android-ci-actions/actions/gradle-cache@main with: