From 38d3fd63b36c0467768f292ff50f1d6f01bc1d9c Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Mon, 6 Jul 2026 12:05:32 +0200 Subject: [PATCH 01/73] ci: add least-privilege permissions to GitHub Actions workflows Restrict default GITHUB_TOKEN scope per workflow. Write scopes granted only where jobs dispatch/cancel workflows, publish packages, or label issues/PRs. Refs: APPSEC-164 --- .github/workflows/apk-s3-distribute.yml | 3 +++ .github/workflows/app-distribute-v7.yml | 3 +++ .github/workflows/app-distribute.yml | 3 +++ .github/workflows/build-and-test.yml | 4 ++++ .github/workflows/clean-detekt-baseline.yaml | 4 ++++ .github/workflows/e2e-build.yml | 3 +++ .github/workflows/e2e-test-backend.yml | 3 +++ .github/workflows/e2e-test-cron.yml | 3 +++ .github/workflows/e2e-test.yml | 3 +++ .github/workflows/no-response.yml | 4 ++++ .github/workflows/pr-checks.yml | 4 ++++ .github/workflows/publish-new-version.yml | 3 +++ .github/workflows/sdk-size-updates.yml | 3 +++ .github/workflows/snapshot-test.yaml | 4 ++++ 14 files changed, 47 insertions(+) diff --git a/.github/workflows/apk-s3-distribute.yml b/.github/workflows/apk-s3-distribute.yml index 515651265db..e9f059ddf7a 100644 --- a/.github/workflows/apk-s3-distribute.yml +++ b/.github/workflows/apk-s3-distribute.yml @@ -6,6 +6,9 @@ on: types: - completed +permissions: + contents: read + jobs: build_ui_components_sample_app: name: Build and push to S3 diff --git a/.github/workflows/app-distribute-v7.yml b/.github/workflows/app-distribute-v7.yml index 1c5e516ba3a..742ddaa6a13 100644 --- a/.github/workflows/app-distribute-v7.yml +++ b/.github/workflows/app-distribute-v7.yml @@ -9,6 +9,9 @@ on: - v7 workflow_dispatch: +permissions: + contents: read + jobs: build_compose_sample_app: name: Build and Distribute Compose Sample App diff --git a/.github/workflows/app-distribute.yml b/.github/workflows/app-distribute.yml index 2e5909a34a6..2dbda575d14 100644 --- a/.github/workflows/app-distribute.yml +++ b/.github/workflows/app-distribute.yml @@ -6,6 +6,9 @@ on: - develop - main +permissions: + contents: read + jobs: build_ui_components_sample_app: name: Build and Distribute UI Components Sample App diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 79976c31b31..20acc2eaf36 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -10,6 +10,10 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + pull-requests: read + jobs: debug_build: name: Debug build diff --git a/.github/workflows/clean-detekt-baseline.yaml b/.github/workflows/clean-detekt-baseline.yaml index 99e057ab6dd..db168c08088 100644 --- a/.github/workflows/clean-detekt-baseline.yaml +++ b/.github/workflows/clean-detekt-baseline.yaml @@ -5,6 +5,10 @@ on: # Every midnight - cron: "0 0 * * *" +permissions: + contents: read + pull-requests: read + jobs: clean_detekt_baseline_files: name: Clean Detekt Baseline Files diff --git a/.github/workflows/e2e-build.yml b/.github/workflows/e2e-build.yml index 8a26fdf5abd..4fb9ec63c58 100644 --- a/.github/workflows/e2e-build.yml +++ b/.github/workflows/e2e-build.yml @@ -13,6 +13,9 @@ env: BUILD_CACHE_AWS_ACCESS_KEY_ID: ${{ secrets.BUILD_CACHE_AWS_ACCESS_KEY_ID }} BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} +permissions: + contents: read + jobs: build: name: ${{ inputs.app }} apks diff --git a/.github/workflows/e2e-test-backend.yml b/.github/workflows/e2e-test-backend.yml index 10dfbda35bc..c8d8ce539ee 100644 --- a/.github/workflows/e2e-test-backend.yml +++ b/.github/workflows/e2e-test-backend.yml @@ -10,6 +10,9 @@ env: BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} +permissions: + contents: read + jobs: test-backend-integration: name: Test Backend Integration diff --git a/.github/workflows/e2e-test-cron.yml b/.github/workflows/e2e-test-cron.yml index 6ce5985b6a5..681432e2254 100644 --- a/.github/workflows/e2e-test-cron.yml +++ b/.github/workflows/e2e-test-cron.yml @@ -17,6 +17,9 @@ concurrency: group: ${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + env: BUILD_CACHE_AWS_REGION: ${{ secrets.BUILD_CACHE_AWS_REGION }} BUILD_CACHE_AWS_BUCKET: ${{ secrets.BUILD_CACHE_AWS_BUCKET }} diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml index af701effa21..a550042063b 100644 --- a/.github/workflows/e2e-test.yml +++ b/.github/workflows/e2e-test.yml @@ -15,6 +15,9 @@ concurrency: group: ${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + env: BUILD_CACHE_AWS_REGION: ${{ secrets.BUILD_CACHE_AWS_REGION }} BUILD_CACHE_AWS_BUCKET: ${{ secrets.BUILD_CACHE_AWS_BUCKET }} diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml index 3bd72f76625..08a9f1f26f4 100644 --- a/.github/workflows/no-response.yml +++ b/.github/workflows/no-response.yml @@ -7,6 +7,10 @@ on: # Every midnight - cron: '0 0 * * *' +permissions: + issues: write + pull-requests: write + jobs: noResponse: runs-on: ubuntu-22.04 diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index c26f45e6a6f..09ef4a95bd2 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -6,6 +6,10 @@ concurrency: group: ${{ github.head_ref }} cancel-in-progress: true +permissions: + contents: read + pull-requests: read + jobs: base-android-ci: uses: GetStream/stream-build-conventions-android/.github/workflows/android-ci.yml@v0.13.1 diff --git a/.github/workflows/publish-new-version.yml b/.github/workflows/publish-new-version.yml index 23a00e9786a..20efb23de02 100644 --- a/.github/workflows/publish-new-version.yml +++ b/.github/workflows/publish-new-version.yml @@ -23,6 +23,9 @@ concurrency: group: release cancel-in-progress: false +permissions: + contents: read + jobs: pre_release_check: name: Pre release check diff --git a/.github/workflows/sdk-size-updates.yml b/.github/workflows/sdk-size-updates.yml index 44ce33110dd..9810e1f7279 100644 --- a/.github/workflows/sdk-size-updates.yml +++ b/.github/workflows/sdk-size-updates.yml @@ -11,6 +11,9 @@ concurrency: group: ${{ github.workflow }} cancel-in-progress: true +permissions: + pull-requests: write + jobs: update-sdk-sizes: uses: GetStream/stream-build-conventions-android/.github/workflows/sdk-size-updates.yml@v0.13.1 diff --git a/.github/workflows/snapshot-test.yaml b/.github/workflows/snapshot-test.yaml index ab20a10ce95..5f508bef6f2 100644 --- a/.github/workflows/snapshot-test.yaml +++ b/.github/workflows/snapshot-test.yaml @@ -15,6 +15,10 @@ env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_PR_NUM: ${{ github.event.pull_request.number }} +permissions: + contents: read + pull-requests: read + jobs: run_snapshot_tests: name: Run From 7a46043c179e3a9085a0e49943a57bf9a1b9febf Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Mon, 6 Jul 2026 12:06:50 +0200 Subject: [PATCH 02/73] ci: fix permissions block YAML indentation --- .github/workflows/build-and-test.yml | 2 +- .github/workflows/clean-detekt-baseline.yaml | 2 +- .github/workflows/no-response.yml | 2 +- .github/workflows/pr-checks.yml | 2 +- .github/workflows/snapshot-test.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 20acc2eaf36..9ce6e1a8ec5 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -12,7 +12,7 @@ concurrency: permissions: contents: read - pull-requests: read + pull-requests: read jobs: debug_build: diff --git a/.github/workflows/clean-detekt-baseline.yaml b/.github/workflows/clean-detekt-baseline.yaml index db168c08088..b84fa801d52 100644 --- a/.github/workflows/clean-detekt-baseline.yaml +++ b/.github/workflows/clean-detekt-baseline.yaml @@ -7,7 +7,7 @@ on: permissions: contents: read - pull-requests: read + pull-requests: read jobs: clean_detekt_baseline_files: diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml index 08a9f1f26f4..4e05d640e3c 100644 --- a/.github/workflows/no-response.yml +++ b/.github/workflows/no-response.yml @@ -9,7 +9,7 @@ on: permissions: issues: write - pull-requests: write + pull-requests: write jobs: noResponse: diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 09ef4a95bd2..c1809f83b71 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -8,7 +8,7 @@ concurrency: permissions: contents: read - pull-requests: read + pull-requests: read jobs: base-android-ci: diff --git a/.github/workflows/snapshot-test.yaml b/.github/workflows/snapshot-test.yaml index 5f508bef6f2..20bef116715 100644 --- a/.github/workflows/snapshot-test.yaml +++ b/.github/workflows/snapshot-test.yaml @@ -17,7 +17,7 @@ env: permissions: contents: read - pull-requests: read + pull-requests: read jobs: run_snapshot_tests: From c58eda1509457b5c981671897e2502c0be5e87f9 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:42:52 +0200 Subject: [PATCH 03/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/apk-s3-distribute.yml | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/.github/workflows/apk-s3-distribute.yml b/.github/workflows/apk-s3-distribute.yml index e9f059ddf7a..e93c01beadc 100644 --- a/.github/workflows/apk-s3-distribute.yml +++ b/.github/workflows/apk-s3-distribute.yml @@ -5,24 +5,26 @@ on: workflows: ["ReleasePost", "PublishHotfix"] types: - completed - -permissions: - contents: read - jobs: build_ui_components_sample_app: name: Build and push to S3 runs-on: ubuntu-22.04 + permissions: + contents: read steps: - - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Prepare environment + env: + PASSPHRASE: ${{ secrets.PASSPHRASE }} + RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }} + RELEASE_KEYSTORE_PROPERTIES: ${{ secrets.RELEASE_KEYSTORE_PROPERTIES }} run: | git fetch --unshallow - echo "${{ secrets.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore - echo "${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties + echo "${{ env.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore + echo "${{ env.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties - name: Assemble run: ./gradlew :stream-chat-android-ui-components-sample:assembleDemoRelease --stacktrace - name: Configure AWS credentials From 38435108a957e4359991114cdf4e92cbf88a3050 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:42:54 +0200 Subject: [PATCH 04/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/app-distribute-v7.yml | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/.github/workflows/app-distribute-v7.yml b/.github/workflows/app-distribute-v7.yml index 742ddaa6a13..1179955cc98 100644 --- a/.github/workflows/app-distribute-v7.yml +++ b/.github/workflows/app-distribute-v7.yml @@ -8,24 +8,26 @@ on: branches: - v7 workflow_dispatch: - -permissions: - contents: read - jobs: build_compose_sample_app: name: Build and Distribute Compose Sample App runs-on: ubuntu-24.04 + permissions: + contents: read steps: - - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Prepare environment + env: + PASSPHRASE: ${{ secrets.PASSPHRASE }} + RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }} + RELEASE_KEYSTORE_PROPERTIES: ${{ secrets.RELEASE_KEYSTORE_PROPERTIES }} run: | git fetch --unshallow - echo "${{ secrets.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore - echo "${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties + echo "${{ env.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore + echo "${{ env.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties - name: Assemble run: ./gradlew :stream-chat-android-compose-sample:assembleRelease --stacktrace - name: Upload artifact to Firebase App Distribution From 0650e70f75cc61cf6af0f101acf0112082db5e45 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:42:55 +0200 Subject: [PATCH 05/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/app-distribute.yml | 41 ++++++++++++++++------------ 1 file changed, 24 insertions(+), 17 deletions(-) diff --git a/.github/workflows/app-distribute.yml b/.github/workflows/app-distribute.yml index 2dbda575d14..473300a7146 100644 --- a/.github/workflows/app-distribute.yml +++ b/.github/workflows/app-distribute.yml @@ -5,24 +5,26 @@ on: branches: - develop - main - -permissions: - contents: read - jobs: build_ui_components_sample_app: name: Build and Distribute UI Components Sample App runs-on: ubuntu-22.04 + permissions: + contents: read steps: - - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Prepare environment + env: + PASSPHRASE: ${{ secrets.PASSPHRASE }} + RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }} + RELEASE_KEYSTORE_PROPERTIES: ${{ secrets.RELEASE_KEYSTORE_PROPERTIES }} run: | git fetch --unshallow - echo "${{ secrets.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore - echo "${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties + echo "${{ env.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore + echo "${{ env.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties - name: Assemble run: bash ./gradlew :stream-chat-android-ui-components-sample:assembleDemoRelease --stacktrace - name: Upload APK @@ -37,20 +39,25 @@ jobs: serviceCredentialsFileContent: ${{ secrets.CREDENTIAL_FILE_CONTENT }} groups: stream-testers file: stream-chat-android-ui-components-sample/build/outputs/apk/demo/release/stream-chat-android-ui-components-sample-demo-release.apk - build_compose_sample_app: name: Build and Distribute Compose Sample App runs-on: ubuntu-22.04 + permissions: + contents: read steps: - - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Prepare environment + env: + PASSPHRASE: ${{ secrets.PASSPHRASE }} + RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }} + RELEASE_KEYSTORE_PROPERTIES: ${{ secrets.RELEASE_KEYSTORE_PROPERTIES }} run: | git fetch --unshallow - echo "${{ secrets.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore - echo "${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc - gpg -d --passphrase "${{ secrets.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties + echo "${{ env.RELEASE_KEYSTORE }}" > .sign/release.keystore.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/release.keystore.asc > .sign/release.keystore + echo "${{ env.RELEASE_KEYSTORE_PROPERTIES }}" > .sign/keystore.properties.asc + gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties - name: Assemble run: bash ./gradlew :stream-chat-android-compose-sample:assembleRelease --stacktrace - name: Upload APK From 6127aa85479958607a62f645d96f23721c6815b4 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:42:57 +0200 Subject: [PATCH 06/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/build-and-test.yml | 44 ++++++++++++++++------------ 1 file changed, 25 insertions(+), 19 deletions(-) diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 9ce6e1a8ec5..049a2823a54 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -9,41 +9,43 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - -permissions: - contents: read - pull-requests: read - jobs: debug_build: name: Debug build runs-on: ubuntu-22.04 + permissions: + contents: read + pull-requests: read steps: - name: Check out code - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Build run: ./gradlew assembleDebug - release_build: name: Release build runs-on: ubuntu-22.04 + permissions: + contents: read + pull-requests: read steps: - name: Check out code - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Build run: ./gradlew assembleRelease - tests: name: Tests runs-on: ubuntu-22.04 + permissions: + contents: read + pull-requests: read steps: - name: Check out code - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 with: fetch-depth: 0 # fetch all history for sonar analysis - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Unit tests run: ./gradlew :testCoverage - name: Upload test results @@ -57,14 +59,16 @@ jobs: run: bundle exec fastlane run_sonar_analysis env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - size_check_xml: name: Size Check XML runs-on: ubuntu-22.04 + permissions: + contents: read + pull-requests: read steps: - name: Check out code - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: build demo debug run: ./gradlew stream-chat-android-ui-components-sample:assembleDemoDebug - name: Upload artifact to Emerge @@ -73,14 +77,16 @@ jobs: artifact_path: ./stream-chat-android-ui-components-sample/build/outputs/apk/demo/debug/stream-chat-android-ui-components-sample-demo-debug.apk emerge_api_key: ${{ secrets.EMERGE_TOOLS_API_KEY }} build_type: debug - size_check_compose: name: Size Check Compose runs-on: ubuntu-22.04 + permissions: + contents: read + pull-requests: read steps: - name: Check out code - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: build debug run: ./gradlew stream-chat-android-compose-sample:assembleDebug - name: Upload artifact to Emerge From 714b30f2d04dd258a7c4f9c83b85b697e24876f4 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:42:58 +0200 Subject: [PATCH 07/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/clean-detekt-baseline.yaml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/.github/workflows/clean-detekt-baseline.yaml b/.github/workflows/clean-detekt-baseline.yaml index b84fa801d52..339a39b44d8 100644 --- a/.github/workflows/clean-detekt-baseline.yaml +++ b/.github/workflows/clean-detekt-baseline.yaml @@ -4,21 +4,19 @@ on: schedule: # Every midnight - cron: "0 0 * * *" - -permissions: - contents: read - pull-requests: read - jobs: clean_detekt_baseline_files: name: Clean Detekt Baseline Files runs-on: ubuntu-22.04 + permissions: + contents: read + pull-requests: read steps: - name: Check out code - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 with: token: ${{ secrets.STREAM_PUBLIC_BOT_TOKEN }} - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: tibdex/github-app-token@v2.1.0 id: generate-token with: From 3f5a114e8bfd09be85555ae6b55a616ebdfb6cca Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:43:00 +0200 Subject: [PATCH 08/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/e2e-build.yml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/e2e-build.yml b/.github/workflows/e2e-build.yml index 4fb9ec63c58..edd6c891b24 100644 --- a/.github/workflows/e2e-build.yml +++ b/.github/workflows/e2e-build.yml @@ -12,17 +12,15 @@ env: BUILD_CACHE_AWS_BUCKET: ${{ secrets.BUILD_CACHE_AWS_BUCKET }} BUILD_CACHE_AWS_ACCESS_KEY_ID: ${{ secrets.BUILD_CACHE_AWS_ACCESS_KEY_ID }} BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} - -permissions: - contents: read - jobs: build: name: ${{ inputs.app }} apks runs-on: ubuntu-24.04 + permissions: + contents: read steps: - - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/enable-kvm@main - uses: GetStream/android-ci-actions/actions/setup-ruby@main - uses: GetStream/android-ci-actions/actions/gradle-cache@main From 1d0ade51789910e8bb4d96ba657d2540ca1c62f6 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:43:01 +0200 Subject: [PATCH 09/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/e2e-test-backend.yml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/e2e-test-backend.yml b/.github/workflows/e2e-test-backend.yml index c8d8ce539ee..a7246a50c09 100644 --- a/.github/workflows/e2e-test-backend.yml +++ b/.github/workflows/e2e-test-backend.yml @@ -9,19 +9,17 @@ env: BUILD_CACHE_AWS_ACCESS_KEY_ID: ${{ secrets.BUILD_CACHE_AWS_ACCESS_KEY_ID }} BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - -permissions: - contents: read - jobs: test-backend-integration: name: Test Backend Integration runs-on: ubuntu-24.04 + permissions: + contents: read env: ANDROID_API_LEVEL: 34 steps: - - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/enable-kvm@main - uses: GetStream/android-ci-actions/actions/setup-ruby@main - name: Run tests From 9df09475fd791c8419e8177ade72878dc7e86b33 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:43:02 +0200 Subject: [PATCH 10/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/e2e-test-cron.yml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/e2e-test-cron.yml b/.github/workflows/e2e-test-cron.yml index 681432e2254..82b84f2503d 100644 --- a/.github/workflows/e2e-test-cron.yml +++ b/.github/workflows/e2e-test-cron.yml @@ -17,8 +17,6 @@ concurrency: group: ${{ github.ref }} cancel-in-progress: true -permissions: - contents: read env: BUILD_CACHE_AWS_REGION: ${{ secrets.BUILD_CACHE_AWS_REGION }} @@ -26,19 +24,21 @@ env: BUILD_CACHE_AWS_ACCESS_KEY_ID: ${{ secrets.BUILD_CACHE_AWS_ACCESS_KEY_ID }} BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - jobs: build-compose-apks: name: Build uses: ./.github/workflows/e2e-build.yml + permissions: + contents: read with: app: compose - run-compose-tests-nightly: name: Test compose runs-on: ubuntu-24.04 needs: build-compose-apks strategy: + permissions: + contents: read matrix: include: - android_api_level: 35 @@ -51,12 +51,12 @@ jobs: env: ANDROID_API_LEVEL: ${{ matrix.android_api_level }} steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 - uses: actions/download-artifact@v8.0.1 continue-on-error: true with: name: apks - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/enable-kvm@main - uses: GetStream/android-ci-actions/actions/setup-ruby@main - uses: GetStream/android-ci-actions/actions/allure-launch@main @@ -92,12 +92,13 @@ jobs: with: name: logs_${{ env.ANDROID_API_LEVEL }} path: fastlane/stream-chat-test-mock-server/logs/* - slack: name: Slack Report runs-on: ubuntu-latest needs: [build-compose-apks, run-compose-tests-nightly] if: failure() && github.event_name == 'schedule' + permissions: + contents: read steps: - uses: 8398a7/action-slack@v3 with: From 8bf49477590c62e34e8263994784ac061e4bfbec Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:43:04 +0200 Subject: [PATCH 11/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/e2e-test.yml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml index a550042063b..4c0c682d795 100644 --- a/.github/workflows/e2e-test.yml +++ b/.github/workflows/e2e-test.yml @@ -15,8 +15,6 @@ concurrency: group: ${{ github.ref }} cancel-in-progress: true -permissions: - contents: read env: BUILD_CACHE_AWS_REGION: ${{ secrets.BUILD_CACHE_AWS_REGION }} @@ -25,29 +23,30 @@ env: BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_PR_NUM: ${{ github.event.pull_request.number }} - jobs: build-compose-apks: name: Build uses: ./.github/workflows/e2e-build.yml + permissions: + contents: read with: app: compose secrets: inherit - allure_testops_launch: name: Launch Allure TestOps runs-on: ubuntu-24.04 needs: build-compose-apks outputs: + permissions: + contents: read launch_id: ${{ env.LAUNCH_ID }} steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 - uses: GetStream/android-ci-actions/actions/setup-ruby@main - uses: GetStream/android-ci-actions/actions/allure-launch@main if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} with: allure-token: ${{ secrets.ALLURE_TOKEN }} - run-compose-tests: name: Test compose runs-on: ubuntu-24.04 @@ -55,6 +54,8 @@ jobs: - build-compose-apks - allure_testops_launch strategy: + permissions: + contents: read matrix: include: - batch: 0 @@ -65,12 +66,12 @@ jobs: ANDROID_API_LEVEL: 34 LAUNCH_ID: ${{ needs.allure_testops_launch.outputs.launch_id }} steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 - uses: actions/download-artifact@v8.0.1 continue-on-error: true with: name: apks - - uses: GetStream/android-ci-actions/actions/setup-java@main + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/enable-kvm@main - uses: GetStream/android-ci-actions/actions/setup-ruby@main - name: Run tests From 58514c2ef60fee6e37370e70c93495cdd5350a6e Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:43:05 +0200 Subject: [PATCH 12/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/no-response.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml index 4e05d640e3c..d41ad6cd79c 100644 --- a/.github/workflows/no-response.yml +++ b/.github/workflows/no-response.yml @@ -6,14 +6,12 @@ on: schedule: # Every midnight - cron: '0 0 * * *' - -permissions: - issues: write - pull-requests: write - jobs: noResponse: runs-on: ubuntu-22.04 + permissions: + issues: write + pull-requests: write steps: - uses: lee-dohm/no-response@v0.5.0 with: From a4b92cdddb1ffa106d57b466a70923e15d654dcf Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:43:07 +0200 Subject: [PATCH 13/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/pr-checks.yml | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index c1809f83b71..36be5e959c5 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -5,29 +5,36 @@ on: [ pull_request ] concurrency: group: ${{ github.head_ref }} cancel-in-progress: true - -permissions: - contents: read - pull-requests: read - jobs: base-android-ci: - uses: GetStream/stream-build-conventions-android/.github/workflows/android-ci.yml@v0.13.1 - secrets: inherit - + uses: GetStream/stream-build-conventions-android/.github/workflows/android-ci.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 + permissions: + contents: read + pull-requests: read + secrets: + BUILD_CACHE_AWS_REGION: ${{ secrets.BUILD_CACHE_AWS_REGION }} + BUILD_CACHE_AWS_BUCKET: ${{ secrets.BUILD_CACHE_AWS_BUCKET }} + BUILD_CACHE_AWS_ACCESS_KEY_ID: ${{ secrets.BUILD_CACHE_AWS_ACCESS_KEY_ID }} + BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} detekt: name: Detekt runs-on: ubuntu-22.04 + permissions: + contents: read + pull-requests: read steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 - uses: GetStream/stream-build-conventions-android/.github/actions/setup-gradle@v0.13.1 - name: Detekt run: ./gradlew detekt - rubocop: name: Rubocop runs-on: ubuntu-22.04 + permissions: + contents: read + pull-requests: read steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 - uses: GetStream/android-ci-actions/actions/setup-ruby@main - run: bundle exec fastlane rubocop From 0f44212c89386a8455a0804343da6606619eb22a Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:43:08 +0200 Subject: [PATCH 14/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/publish-new-version.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/publish-new-version.yml b/.github/workflows/publish-new-version.yml index 20efb23de02..2e349318180 100644 --- a/.github/workflows/publish-new-version.yml +++ b/.github/workflows/publish-new-version.yml @@ -22,15 +22,13 @@ on: concurrency: group: release cancel-in-progress: false - -permissions: - contents: read - jobs: pre_release_check: name: Pre release check runs-on: ubuntu-24.04 environment: 'publish' + permissions: + contents: read steps: - name: Check id: pre_release_check_step @@ -39,7 +37,7 @@ jobs: permissions: contents: write needs: pre_release_check - uses: GetStream/stream-build-conventions-android/.github/workflows/release.yml@v0.13.1 + uses: GetStream/stream-build-conventions-android/.github/workflows/release.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 with: bump: ${{ inputs.bump }} suffix: ${{ inputs.suffix }} From 42fcd6894469f12fe69b67a1b29112cd66d5c983 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:43:10 +0200 Subject: [PATCH 15/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/sdk-size-updates.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/sdk-size-updates.yml b/.github/workflows/sdk-size-updates.yml index 9810e1f7279..cfd2977d672 100644 --- a/.github/workflows/sdk-size-updates.yml +++ b/.github/workflows/sdk-size-updates.yml @@ -10,13 +10,11 @@ on: concurrency: group: ${{ github.workflow }} cancel-in-progress: true - -permissions: - pull-requests: write - jobs: update-sdk-sizes: - uses: GetStream/stream-build-conventions-android/.github/workflows/sdk-size-updates.yml@v0.13.1 + uses: GetStream/stream-build-conventions-android/.github/workflows/sdk-size-updates.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 + permissions: + pull-requests: write with: modules: "stream-chat-android-client stream-chat-android-ui-components stream-chat-android-compose" metrics-project: "stream-chat-android-metrics" From 6ca9f122cf6db54a896bfa03f69299bc6234ca6c Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 15:43:11 +0200 Subject: [PATCH 16/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/snapshot-test.yaml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/.github/workflows/snapshot-test.yaml b/.github/workflows/snapshot-test.yaml index 20bef116715..857fd8b91ce 100644 --- a/.github/workflows/snapshot-test.yaml +++ b/.github/workflows/snapshot-test.yaml @@ -14,19 +14,17 @@ on: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_PR_NUM: ${{ github.event.pull_request.number }} - -permissions: - contents: read - pull-requests: read - jobs: run_snapshot_tests: name: Run runs-on: ubuntu-24.04 + permissions: + contents: read + pull-requests: read steps: - name: Check out code - uses: actions/checkout@v7.0.0 - - uses: GetStream/android-ci-actions/actions/setup-java@main + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/setup-ruby@main - uses: GetStream/android-ci-actions/actions/gradle-cache@main with: From 7e6e4ddbb255f174d960283afea0fa68ecbd16e0 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:18 +0200 Subject: [PATCH 17/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/apk-s3-distribute.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/apk-s3-distribute.yml b/.github/workflows/apk-s3-distribute.yml index e93c01beadc..f1d4746128d 100644 --- a/.github/workflows/apk-s3-distribute.yml +++ b/.github/workflows/apk-s3-distribute.yml @@ -7,9 +7,11 @@ on: - completed jobs: build_ui_components_sample_app: + permissions: + contents: read + id-token: write name: Build and push to S3 runs-on: ubuntu-22.04 - permissions: contents: read steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 From e5c00a32b31e9ed730691e9978b31f6a738a1730 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:20 +0200 Subject: [PATCH 18/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/app-distribute-v7.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/app-distribute-v7.yml b/.github/workflows/app-distribute-v7.yml index 1179955cc98..c2cc0f9533f 100644 --- a/.github/workflows/app-distribute-v7.yml +++ b/.github/workflows/app-distribute-v7.yml @@ -10,9 +10,10 @@ on: workflow_dispatch: jobs: build_compose_sample_app: + permissions: + contents: read name: Build and Distribute Compose Sample App runs-on: ubuntu-24.04 - permissions: contents: read steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 From 97b353a20a2ca22cb33a43edcdf64e5f7bb71859 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:21 +0200 Subject: [PATCH 19/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/app-distribute.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/app-distribute.yml b/.github/workflows/app-distribute.yml index 473300a7146..da791d4e9e2 100644 --- a/.github/workflows/app-distribute.yml +++ b/.github/workflows/app-distribute.yml @@ -7,9 +7,11 @@ on: - main jobs: build_ui_components_sample_app: + permissions: + actions: write + contents: read name: Build and Distribute UI Components Sample App runs-on: ubuntu-22.04 - permissions: contents: read steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 @@ -40,9 +42,11 @@ jobs: groups: stream-testers file: stream-chat-android-ui-components-sample/build/outputs/apk/demo/release/stream-chat-android-ui-components-sample-demo-release.apk build_compose_sample_app: + permissions: + actions: write + contents: read name: Build and Distribute Compose Sample App runs-on: ubuntu-22.04 - permissions: contents: read steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 From 7d7bd766ff67d1a87165a1b7ae57754da250fdaa Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:23 +0200 Subject: [PATCH 20/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/build-and-test.yml | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 049a2823a54..7e1cb29bd37 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -11,9 +11,11 @@ concurrency: cancel-in-progress: true jobs: debug_build: + permissions: + actions: write + contents: read name: Debug build runs-on: ubuntu-22.04 - permissions: contents: read pull-requests: read steps: @@ -23,9 +25,11 @@ jobs: - name: Build run: ./gradlew assembleDebug release_build: + permissions: + actions: write + contents: read name: Release build runs-on: ubuntu-22.04 - permissions: contents: read pull-requests: read steps: @@ -35,9 +39,11 @@ jobs: - name: Build run: ./gradlew assembleRelease tests: + permissions: + actions: write + contents: read name: Tests runs-on: ubuntu-22.04 - permissions: contents: read pull-requests: read steps: @@ -60,9 +66,11 @@ jobs: env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} size_check_xml: + permissions: + actions: write + contents: read name: Size Check XML runs-on: ubuntu-22.04 - permissions: contents: read pull-requests: read steps: @@ -78,9 +86,11 @@ jobs: emerge_api_key: ${{ secrets.EMERGE_TOOLS_API_KEY }} build_type: debug size_check_compose: + permissions: + actions: write + contents: read name: Size Check Compose runs-on: ubuntu-22.04 - permissions: contents: read pull-requests: read steps: From b4f52169f5d8adb1eac44cfd6fc997dc4a4569ed Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:24 +0200 Subject: [PATCH 21/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/clean-detekt-baseline.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/clean-detekt-baseline.yaml b/.github/workflows/clean-detekt-baseline.yaml index 339a39b44d8..fc62529de6e 100644 --- a/.github/workflows/clean-detekt-baseline.yaml +++ b/.github/workflows/clean-detekt-baseline.yaml @@ -6,9 +6,11 @@ on: - cron: "0 0 * * *" jobs: clean_detekt_baseline_files: + permissions: + contents: read + pull-requests: write name: Clean Detekt Baseline Files runs-on: ubuntu-22.04 - permissions: contents: read pull-requests: read steps: From 8689117ce2f20ec67413e5f1d17c3a03a2d33a85 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:26 +0200 Subject: [PATCH 22/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/e2e-build.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/e2e-build.yml b/.github/workflows/e2e-build.yml index edd6c891b24..463ee7e318f 100644 --- a/.github/workflows/e2e-build.yml +++ b/.github/workflows/e2e-build.yml @@ -14,9 +14,11 @@ env: BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} jobs: build: + permissions: + actions: write + contents: read name: ${{ inputs.app }} apks runs-on: ubuntu-24.04 - permissions: contents: read steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 From e2d711c280d24f331a2f132be8be7786672ce95f Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:27 +0200 Subject: [PATCH 23/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/e2e-test-backend.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/e2e-test-backend.yml b/.github/workflows/e2e-test-backend.yml index a7246a50c09..92a757f6c96 100644 --- a/.github/workflows/e2e-test-backend.yml +++ b/.github/workflows/e2e-test-backend.yml @@ -11,9 +11,11 @@ env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} jobs: test-backend-integration: + permissions: + actions: write + contents: read name: Test Backend Integration runs-on: ubuntu-24.04 - permissions: contents: read env: ANDROID_API_LEVEL: 34 From 39ea3c4fe35fba580207e863baebbeacd3a0a905 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:29 +0200 Subject: [PATCH 24/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/e2e-test-cron.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/e2e-test-cron.yml b/.github/workflows/e2e-test-cron.yml index 82b84f2503d..f2d4e0e8c67 100644 --- a/.github/workflows/e2e-test-cron.yml +++ b/.github/workflows/e2e-test-cron.yml @@ -26,18 +26,22 @@ env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} jobs: build-compose-apks: + permissions: + actions: write + contents: read name: Build uses: ./.github/workflows/e2e-build.yml - permissions: contents: read with: app: compose run-compose-tests-nightly: + permissions: + actions: write + contents: read name: Test compose runs-on: ubuntu-24.04 needs: build-compose-apks strategy: - permissions: contents: read matrix: include: @@ -93,11 +97,13 @@ jobs: name: logs_${{ env.ANDROID_API_LEVEL }} path: fastlane/stream-chat-test-mock-server/logs/* slack: + permissions: + actions: write + contents: read name: Slack Report runs-on: ubuntu-latest needs: [build-compose-apks, run-compose-tests-nightly] if: failure() && github.event_name == 'schedule' - permissions: contents: read steps: - uses: 8398a7/action-slack@v3 From 9641869cdc655b5be97d34ac29dbe8ddedfd5088 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:30 +0200 Subject: [PATCH 25/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/e2e-test.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml index 4c0c682d795..461c02f055e 100644 --- a/.github/workflows/e2e-test.yml +++ b/.github/workflows/e2e-test.yml @@ -25,19 +25,25 @@ env: GITHUB_PR_NUM: ${{ github.event.pull_request.number }} jobs: build-compose-apks: + permissions: + actions: write + contents: read + pull-requests: read name: Build uses: ./.github/workflows/e2e-build.yml - permissions: contents: read with: app: compose secrets: inherit allure_testops_launch: + permissions: + actions: write + contents: read + pull-requests: read name: Launch Allure TestOps runs-on: ubuntu-24.04 needs: build-compose-apks outputs: - permissions: contents: read launch_id: ${{ env.LAUNCH_ID }} steps: @@ -48,13 +54,16 @@ jobs: with: allure-token: ${{ secrets.ALLURE_TOKEN }} run-compose-tests: + permissions: + actions: write + contents: read + pull-requests: read name: Test compose runs-on: ubuntu-24.04 needs: - build-compose-apks - allure_testops_launch strategy: - permissions: contents: read matrix: include: From 365682de777775136422db4e2117bae3cbbc1352 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:31 +0200 Subject: [PATCH 26/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/no-response.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml index d41ad6cd79c..eccb6bde9e0 100644 --- a/.github/workflows/no-response.yml +++ b/.github/workflows/no-response.yml @@ -8,8 +8,11 @@ on: - cron: '0 0 * * *' jobs: noResponse: - runs-on: ubuntu-22.04 permissions: + contents: read + issues: write + pull-requests: read + runs-on: ubuntu-22.04 issues: write pull-requests: write steps: From 4604833ca8ee398aef16a28b380510ffc2feef16 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:33 +0200 Subject: [PATCH 27/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/pr-checks.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 36be5e959c5..825807ab373 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -7,10 +7,12 @@ concurrency: cancel-in-progress: true jobs: base-android-ci: - uses: GetStream/stream-build-conventions-android/.github/workflows/android-ci.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 permissions: contents: read pull-requests: read + uses: GetStream/stream-build-conventions-android/.github/workflows/android-ci.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 + contents: read + pull-requests: read secrets: BUILD_CACHE_AWS_REGION: ${{ secrets.BUILD_CACHE_AWS_REGION }} BUILD_CACHE_AWS_BUCKET: ${{ secrets.BUILD_CACHE_AWS_BUCKET }} @@ -18,9 +20,11 @@ jobs: BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} detekt: + permissions: + contents: read + pull-requests: read name: Detekt runs-on: ubuntu-22.04 - permissions: contents: read pull-requests: read steps: @@ -29,9 +33,11 @@ jobs: - name: Detekt run: ./gradlew detekt rubocop: + permissions: + contents: read + pull-requests: read name: Rubocop runs-on: ubuntu-22.04 - permissions: contents: read pull-requests: read steps: From 5943755cb6da8195dfcfb9a1796238225a8acd2f Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:35 +0200 Subject: [PATCH 28/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/publish-new-version.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-new-version.yml b/.github/workflows/publish-new-version.yml index 2e349318180..28f42d1ab33 100644 --- a/.github/workflows/publish-new-version.yml +++ b/.github/workflows/publish-new-version.yml @@ -24,10 +24,11 @@ concurrency: cancel-in-progress: false jobs: pre_release_check: + permissions: + contents: read name: Pre release check runs-on: ubuntu-24.04 environment: 'publish' - permissions: contents: read steps: - name: Check @@ -35,6 +36,7 @@ jobs: run: echo "Pre release check" publish: permissions: + contents: read contents: write needs: pre_release_check uses: GetStream/stream-build-conventions-android/.github/workflows/release.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 From 20350fa3b0a609eaeca81768eaa6845b963755e3 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:37 +0200 Subject: [PATCH 29/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/sdk-size-updates.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/sdk-size-updates.yml b/.github/workflows/sdk-size-updates.yml index cfd2977d672..2058a6b0f5b 100644 --- a/.github/workflows/sdk-size-updates.yml +++ b/.github/workflows/sdk-size-updates.yml @@ -12,8 +12,9 @@ concurrency: cancel-in-progress: true jobs: update-sdk-sizes: - uses: GetStream/stream-build-conventions-android/.github/workflows/sdk-size-updates.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 permissions: + contents: read + uses: GetStream/stream-build-conventions-android/.github/workflows/sdk-size-updates.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 pull-requests: write with: modules: "stream-chat-android-client stream-chat-android-ui-components stream-chat-android-compose" From c9bca678ace1e320d559966d1efd62d036b2d067 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:07:38 +0200 Subject: [PATCH 30/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/snapshot-test.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/snapshot-test.yaml b/.github/workflows/snapshot-test.yaml index 857fd8b91ce..ba47e7b1a23 100644 --- a/.github/workflows/snapshot-test.yaml +++ b/.github/workflows/snapshot-test.yaml @@ -16,9 +16,12 @@ env: GITHUB_PR_NUM: ${{ github.event.pull_request.number }} jobs: run_snapshot_tests: + permissions: + actions: write + contents: read + pull-requests: write name: Run runs-on: ubuntu-24.04 - permissions: contents: read pull-requests: read steps: From 30d387b53ee3359f1eb0f84ecd4aec5372500146 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:38 +0200 Subject: [PATCH 31/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/apk-s3-distribute.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/apk-s3-distribute.yml b/.github/workflows/apk-s3-distribute.yml index f1d4746128d..ba40c2ed080 100644 --- a/.github/workflows/apk-s3-distribute.yml +++ b/.github/workflows/apk-s3-distribute.yml @@ -10,11 +10,13 @@ jobs: permissions: contents: read id-token: write + contents: read + id-token: write name: Build and push to S3 runs-on: ubuntu-22.04 contents: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Prepare environment env: From 69aa5d49fc8a8c420a62aba37b2bc4e93005a789 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:39 +0200 Subject: [PATCH 32/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/app-distribute-v7.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/app-distribute-v7.yml b/.github/workflows/app-distribute-v7.yml index c2cc0f9533f..544dd793f15 100644 --- a/.github/workflows/app-distribute-v7.yml +++ b/.github/workflows/app-distribute-v7.yml @@ -12,11 +12,12 @@ jobs: build_compose_sample_app: permissions: contents: read + contents: read name: Build and Distribute Compose Sample App runs-on: ubuntu-24.04 contents: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Prepare environment env: From a00a46cdfc6a2dfd995bbd9633f9ae9b3bb5d499 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:41 +0200 Subject: [PATCH 33/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/app-distribute.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/app-distribute.yml b/.github/workflows/app-distribute.yml index da791d4e9e2..00f41463d03 100644 --- a/.github/workflows/app-distribute.yml +++ b/.github/workflows/app-distribute.yml @@ -10,11 +10,13 @@ jobs: permissions: actions: write contents: read + actions: write + contents: read name: Build and Distribute UI Components Sample App runs-on: ubuntu-22.04 contents: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Prepare environment env: @@ -45,11 +47,13 @@ jobs: permissions: actions: write contents: read + actions: write + contents: read name: Build and Distribute Compose Sample App runs-on: ubuntu-22.04 contents: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Prepare environment env: From 83bde7a0a899817fe7572f750d073c5b8da5e62c Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:42 +0200 Subject: [PATCH 34/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/build-and-test.yml | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 7e1cb29bd37..e9082b00d35 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -14,13 +14,15 @@ jobs: permissions: actions: write contents: read + actions: write + contents: read name: Debug build runs-on: ubuntu-22.04 contents: read pull-requests: read steps: - name: Check out code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Build run: ./gradlew assembleDebug @@ -28,13 +30,15 @@ jobs: permissions: actions: write contents: read + actions: write + contents: read name: Release build runs-on: ubuntu-22.04 contents: read pull-requests: read steps: - name: Check out code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: Build run: ./gradlew assembleRelease @@ -42,13 +46,15 @@ jobs: permissions: actions: write contents: read + actions: write + contents: read name: Tests runs-on: ubuntu-22.04 contents: read pull-requests: read steps: - name: Check out code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: fetch-depth: 0 # fetch all history for sonar analysis - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b @@ -69,13 +75,15 @@ jobs: permissions: actions: write contents: read + actions: write + contents: read name: Size Check XML runs-on: ubuntu-22.04 contents: read pull-requests: read steps: - name: Check out code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: build demo debug run: ./gradlew stream-chat-android-ui-components-sample:assembleDemoDebug @@ -89,13 +97,15 @@ jobs: permissions: actions: write contents: read + actions: write + contents: read name: Size Check Compose runs-on: ubuntu-22.04 contents: read pull-requests: read steps: - name: Check out code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - name: build debug run: ./gradlew stream-chat-android-compose-sample:assembleDebug From 9400b1b1142f781c2671d3dcf5d4cc1a93c42367 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:44 +0200 Subject: [PATCH 35/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/clean-detekt-baseline.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/clean-detekt-baseline.yaml b/.github/workflows/clean-detekt-baseline.yaml index fc62529de6e..5ad224118b7 100644 --- a/.github/workflows/clean-detekt-baseline.yaml +++ b/.github/workflows/clean-detekt-baseline.yaml @@ -9,13 +9,15 @@ jobs: permissions: contents: read pull-requests: write + contents: read + pull-requests: write name: Clean Detekt Baseline Files runs-on: ubuntu-22.04 contents: read pull-requests: read steps: - name: Check out code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: token: ${{ secrets.STREAM_PUBLIC_BOT_TOKEN }} - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b From 4426d61a60cfcf1660f1859d0c92bbbda42eb28e Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:46 +0200 Subject: [PATCH 36/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/e2e-build.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/e2e-build.yml b/.github/workflows/e2e-build.yml index 463ee7e318f..3a2ecf4ef01 100644 --- a/.github/workflows/e2e-build.yml +++ b/.github/workflows/e2e-build.yml @@ -17,11 +17,13 @@ jobs: permissions: actions: write contents: read + actions: write + contents: read name: ${{ inputs.app }} apks runs-on: ubuntu-24.04 contents: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/enable-kvm@main - uses: GetStream/android-ci-actions/actions/setup-ruby@main From 0b87cf82917125a4dcba22b96c9ec8af928f2b21 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:47 +0200 Subject: [PATCH 37/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/e2e-test-backend.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/e2e-test-backend.yml b/.github/workflows/e2e-test-backend.yml index 92a757f6c96..0b45c818953 100644 --- a/.github/workflows/e2e-test-backend.yml +++ b/.github/workflows/e2e-test-backend.yml @@ -14,13 +14,15 @@ jobs: permissions: actions: write contents: read + actions: write + contents: read name: Test Backend Integration runs-on: ubuntu-24.04 contents: read env: ANDROID_API_LEVEL: 34 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/enable-kvm@main - uses: GetStream/android-ci-actions/actions/setup-ruby@main From dbb4720bdbcd15afc7e797a032c911278a1f4b97 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:48 +0200 Subject: [PATCH 38/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/e2e-test-cron.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/e2e-test-cron.yml b/.github/workflows/e2e-test-cron.yml index f2d4e0e8c67..6d2d1f87bc4 100644 --- a/.github/workflows/e2e-test-cron.yml +++ b/.github/workflows/e2e-test-cron.yml @@ -29,6 +29,8 @@ jobs: permissions: actions: write contents: read + actions: write + contents: read name: Build uses: ./.github/workflows/e2e-build.yml contents: read @@ -38,6 +40,8 @@ jobs: permissions: actions: write contents: read + actions: write + contents: read name: Test compose runs-on: ubuntu-24.04 needs: build-compose-apks @@ -55,7 +59,7 @@ jobs: env: ANDROID_API_LEVEL: ${{ matrix.android_api_level }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: actions/download-artifact@v8.0.1 continue-on-error: true with: @@ -100,6 +104,8 @@ jobs: permissions: actions: write contents: read + actions: write + contents: read name: Slack Report runs-on: ubuntu-latest needs: [build-compose-apks, run-compose-tests-nightly] From 91dfee98909a2f4987e79481ba91169f663bcf51 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:50 +0200 Subject: [PATCH 39/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/e2e-test.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml index 461c02f055e..3453e15e4b2 100644 --- a/.github/workflows/e2e-test.yml +++ b/.github/workflows/e2e-test.yml @@ -29,6 +29,9 @@ jobs: actions: write contents: read pull-requests: read + actions: write + contents: read + pull-requests: read name: Build uses: ./.github/workflows/e2e-build.yml contents: read @@ -40,6 +43,9 @@ jobs: actions: write contents: read pull-requests: read + actions: write + contents: read + pull-requests: read name: Launch Allure TestOps runs-on: ubuntu-24.04 needs: build-compose-apks @@ -47,7 +53,7 @@ jobs: contents: read launch_id: ${{ env.LAUNCH_ID }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-ruby@main - uses: GetStream/android-ci-actions/actions/allure-launch@main if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} @@ -58,6 +64,9 @@ jobs: actions: write contents: read pull-requests: read + actions: write + contents: read + pull-requests: read name: Test compose runs-on: ubuntu-24.04 needs: @@ -75,7 +84,7 @@ jobs: ANDROID_API_LEVEL: 34 LAUNCH_ID: ${{ needs.allure_testops_launch.outputs.launch_id }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: actions/download-artifact@v8.0.1 continue-on-error: true with: From cea9db09faea028be95527833648e07bf8aeea3e Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:51 +0200 Subject: [PATCH 40/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/no-response.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml index eccb6bde9e0..f4618919614 100644 --- a/.github/workflows/no-response.yml +++ b/.github/workflows/no-response.yml @@ -12,6 +12,9 @@ jobs: contents: read issues: write pull-requests: read + contents: read + issues: write + pull-requests: read runs-on: ubuntu-22.04 issues: write pull-requests: write From a29df6f58f659f469fb927062d0ff064ec327ca1 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:53 +0200 Subject: [PATCH 41/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/pr-checks.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 825807ab373..8c051af5d4f 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -10,6 +10,8 @@ jobs: permissions: contents: read pull-requests: read + contents: read + pull-requests: read uses: GetStream/stream-build-conventions-android/.github/workflows/android-ci.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 contents: read pull-requests: read @@ -23,12 +25,14 @@ jobs: permissions: contents: read pull-requests: read + contents: read + pull-requests: read name: Detekt runs-on: ubuntu-22.04 contents: read pull-requests: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/stream-build-conventions-android/.github/actions/setup-gradle@v0.13.1 - name: Detekt run: ./gradlew detekt @@ -36,11 +40,13 @@ jobs: permissions: contents: read pull-requests: read + contents: read + pull-requests: read name: Rubocop runs-on: ubuntu-22.04 contents: read pull-requests: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-ruby@main - run: bundle exec fastlane rubocop From 089991ae2070d67252c83efb4e8da7e355e8c5e8 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:54 +0200 Subject: [PATCH 42/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/publish-new-version.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/publish-new-version.yml b/.github/workflows/publish-new-version.yml index 28f42d1ab33..d14c6ff02af 100644 --- a/.github/workflows/publish-new-version.yml +++ b/.github/workflows/publish-new-version.yml @@ -26,6 +26,7 @@ jobs: pre_release_check: permissions: contents: read + contents: read name: Pre release check runs-on: ubuntu-24.04 environment: 'publish' @@ -36,6 +37,7 @@ jobs: run: echo "Pre release check" publish: permissions: + contents: read contents: read contents: write needs: pre_release_check From 35959dd06750f88f29b3150d62433341822a759b Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:55 +0200 Subject: [PATCH 43/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/sdk-size-updates.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/sdk-size-updates.yml b/.github/workflows/sdk-size-updates.yml index 2058a6b0f5b..894c54b85fb 100644 --- a/.github/workflows/sdk-size-updates.yml +++ b/.github/workflows/sdk-size-updates.yml @@ -14,6 +14,7 @@ jobs: update-sdk-sizes: permissions: contents: read + contents: read uses: GetStream/stream-build-conventions-android/.github/workflows/sdk-size-updates.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 pull-requests: write with: From 6217391b237752ac0f88990bd6a811f937e8c0b8 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:08:57 +0200 Subject: [PATCH 44/73] ci: move workflow permissions to job level (SonarCloud) --- .github/workflows/snapshot-test.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/snapshot-test.yaml b/.github/workflows/snapshot-test.yaml index ba47e7b1a23..2305b6e346a 100644 --- a/.github/workflows/snapshot-test.yaml +++ b/.github/workflows/snapshot-test.yaml @@ -20,13 +20,16 @@ jobs: actions: write contents: read pull-requests: write + actions: write + contents: read + pull-requests: write name: Run runs-on: ubuntu-24.04 contents: read pull-requests: read steps: - name: Check out code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b - uses: GetStream/android-ci-actions/actions/setup-ruby@main - uses: GetStream/android-ci-actions/actions/gradle-cache@main From 50c0fce37f97afd0ca78ed6a000a8bedb2a67659 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:27 +0200 Subject: [PATCH 45/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/apk-s3-distribute.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/apk-s3-distribute.yml b/.github/workflows/apk-s3-distribute.yml index ba40c2ed080..af63b0098cd 100644 --- a/.github/workflows/apk-s3-distribute.yml +++ b/.github/workflows/apk-s3-distribute.yml @@ -10,11 +10,8 @@ jobs: permissions: contents: read id-token: write - contents: read - id-token: write name: Build and push to S3 runs-on: ubuntu-22.04 - contents: read steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b From da9739e5d17f80243ade4bc1e1904a3e00e7f7d6 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:28 +0200 Subject: [PATCH 46/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/app-distribute-v7.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/app-distribute-v7.yml b/.github/workflows/app-distribute-v7.yml index 544dd793f15..a97f329e2cc 100644 --- a/.github/workflows/app-distribute-v7.yml +++ b/.github/workflows/app-distribute-v7.yml @@ -12,10 +12,8 @@ jobs: build_compose_sample_app: permissions: contents: read - contents: read name: Build and Distribute Compose Sample App runs-on: ubuntu-24.04 - contents: read steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b From 53d2e260b62439cff96ed6c7fdcc30531aacdcbc Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:30 +0200 Subject: [PATCH 47/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/app-distribute.yml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/.github/workflows/app-distribute.yml b/.github/workflows/app-distribute.yml index 00f41463d03..f70d39f7233 100644 --- a/.github/workflows/app-distribute.yml +++ b/.github/workflows/app-distribute.yml @@ -10,11 +10,8 @@ jobs: permissions: actions: write contents: read - actions: write - contents: read name: Build and Distribute UI Components Sample App runs-on: ubuntu-22.04 - contents: read steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b @@ -47,11 +44,8 @@ jobs: permissions: actions: write contents: read - actions: write - contents: read name: Build and Distribute Compose Sample App runs-on: ubuntu-22.04 - contents: read steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b From e83b2506a65fa2873a6df34b84b4f74f5ecb3c9f Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:31 +0200 Subject: [PATCH 48/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/build-and-test.yml | 20 -------------------- 1 file changed, 20 deletions(-) diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index e9082b00d35..70886876600 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -14,12 +14,8 @@ jobs: permissions: actions: write contents: read - actions: write - contents: read name: Debug build runs-on: ubuntu-22.04 - contents: read - pull-requests: read steps: - name: Check out code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 @@ -30,12 +26,8 @@ jobs: permissions: actions: write contents: read - actions: write - contents: read name: Release build runs-on: ubuntu-22.04 - contents: read - pull-requests: read steps: - name: Check out code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 @@ -46,12 +38,8 @@ jobs: permissions: actions: write contents: read - actions: write - contents: read name: Tests runs-on: ubuntu-22.04 - contents: read - pull-requests: read steps: - name: Check out code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 @@ -75,12 +63,8 @@ jobs: permissions: actions: write contents: read - actions: write - contents: read name: Size Check XML runs-on: ubuntu-22.04 - contents: read - pull-requests: read steps: - name: Check out code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 @@ -97,12 +81,8 @@ jobs: permissions: actions: write contents: read - actions: write - contents: read name: Size Check Compose runs-on: ubuntu-22.04 - contents: read - pull-requests: read steps: - name: Check out code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 From b2274ca1c5d710fece4302202f9b0ac47c7cb681 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:33 +0200 Subject: [PATCH 49/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/clean-detekt-baseline.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/clean-detekt-baseline.yaml b/.github/workflows/clean-detekt-baseline.yaml index 5ad224118b7..275bf388083 100644 --- a/.github/workflows/clean-detekt-baseline.yaml +++ b/.github/workflows/clean-detekt-baseline.yaml @@ -9,12 +9,8 @@ jobs: permissions: contents: read pull-requests: write - contents: read - pull-requests: write name: Clean Detekt Baseline Files runs-on: ubuntu-22.04 - contents: read - pull-requests: read steps: - name: Check out code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 From 117ccd4979170e0d0c0021cad804407d98552886 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:34 +0200 Subject: [PATCH 50/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/e2e-build.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/e2e-build.yml b/.github/workflows/e2e-build.yml index 3a2ecf4ef01..42ebe48541f 100644 --- a/.github/workflows/e2e-build.yml +++ b/.github/workflows/e2e-build.yml @@ -17,11 +17,8 @@ jobs: permissions: actions: write contents: read - actions: write - contents: read name: ${{ inputs.app }} apks runs-on: ubuntu-24.04 - contents: read steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b From 45235bd382f61c3489c005a93f7681f6ed2a78c4 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:36 +0200 Subject: [PATCH 51/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/e2e-test-backend.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/e2e-test-backend.yml b/.github/workflows/e2e-test-backend.yml index 0b45c818953..fe2c930a2ac 100644 --- a/.github/workflows/e2e-test-backend.yml +++ b/.github/workflows/e2e-test-backend.yml @@ -14,11 +14,8 @@ jobs: permissions: actions: write contents: read - actions: write - contents: read name: Test Backend Integration runs-on: ubuntu-24.04 - contents: read env: ANDROID_API_LEVEL: 34 steps: From 10bb50ea6642b1f4ce42c32ffee63f066baccb45 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:37 +0200 Subject: [PATCH 52/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/e2e-test-cron.yml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/.github/workflows/e2e-test-cron.yml b/.github/workflows/e2e-test-cron.yml index 6d2d1f87bc4..4a3c6f2b1e6 100644 --- a/.github/workflows/e2e-test-cron.yml +++ b/.github/workflows/e2e-test-cron.yml @@ -17,7 +17,6 @@ concurrency: group: ${{ github.ref }} cancel-in-progress: true - env: BUILD_CACHE_AWS_REGION: ${{ secrets.BUILD_CACHE_AWS_REGION }} BUILD_CACHE_AWS_BUCKET: ${{ secrets.BUILD_CACHE_AWS_BUCKET }} @@ -29,24 +28,18 @@ jobs: permissions: actions: write contents: read - actions: write - contents: read name: Build uses: ./.github/workflows/e2e-build.yml - contents: read with: app: compose run-compose-tests-nightly: permissions: actions: write contents: read - actions: write - contents: read name: Test compose runs-on: ubuntu-24.04 needs: build-compose-apks strategy: - contents: read matrix: include: - android_api_level: 35 @@ -104,13 +97,10 @@ jobs: permissions: actions: write contents: read - actions: write - contents: read name: Slack Report runs-on: ubuntu-latest needs: [build-compose-apks, run-compose-tests-nightly] if: failure() && github.event_name == 'schedule' - contents: read steps: - uses: 8398a7/action-slack@v3 with: From 12469056da91baabc950b33c35f02e45ee9cb4a9 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:38 +0200 Subject: [PATCH 53/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/e2e-test.yml | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml index 3453e15e4b2..793ee258c5a 100644 --- a/.github/workflows/e2e-test.yml +++ b/.github/workflows/e2e-test.yml @@ -15,7 +15,6 @@ concurrency: group: ${{ github.ref }} cancel-in-progress: true - env: BUILD_CACHE_AWS_REGION: ${{ secrets.BUILD_CACHE_AWS_REGION }} BUILD_CACHE_AWS_BUCKET: ${{ secrets.BUILD_CACHE_AWS_BUCKET }} @@ -29,12 +28,8 @@ jobs: actions: write contents: read pull-requests: read - actions: write - contents: read - pull-requests: read name: Build uses: ./.github/workflows/e2e-build.yml - contents: read with: app: compose secrets: inherit @@ -43,14 +38,10 @@ jobs: actions: write contents: read pull-requests: read - actions: write - contents: read - pull-requests: read name: Launch Allure TestOps runs-on: ubuntu-24.04 needs: build-compose-apks outputs: - contents: read launch_id: ${{ env.LAUNCH_ID }} steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 @@ -64,16 +55,12 @@ jobs: actions: write contents: read pull-requests: read - actions: write - contents: read - pull-requests: read name: Test compose runs-on: ubuntu-24.04 needs: - build-compose-apks - allure_testops_launch strategy: - contents: read matrix: include: - batch: 0 From 4cb8c55910b787cd2379deaa36f6ab6998fe6ee0 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:40 +0200 Subject: [PATCH 54/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/no-response.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml index f4618919614..016ac6d49cc 100644 --- a/.github/workflows/no-response.yml +++ b/.github/workflows/no-response.yml @@ -12,12 +12,7 @@ jobs: contents: read issues: write pull-requests: read - contents: read - issues: write - pull-requests: read runs-on: ubuntu-22.04 - issues: write - pull-requests: write steps: - uses: lee-dohm/no-response@v0.5.0 with: From d8e154372128af05633ed909feb44ed2cea921dc Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:41 +0200 Subject: [PATCH 55/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/pr-checks.yml | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 8c051af5d4f..88d3acd3153 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -10,11 +10,7 @@ jobs: permissions: contents: read pull-requests: read - contents: read - pull-requests: read uses: GetStream/stream-build-conventions-android/.github/workflows/android-ci.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 - contents: read - pull-requests: read secrets: BUILD_CACHE_AWS_REGION: ${{ secrets.BUILD_CACHE_AWS_REGION }} BUILD_CACHE_AWS_BUCKET: ${{ secrets.BUILD_CACHE_AWS_BUCKET }} @@ -25,12 +21,8 @@ jobs: permissions: contents: read pull-requests: read - contents: read - pull-requests: read name: Detekt runs-on: ubuntu-22.04 - contents: read - pull-requests: read steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/stream-build-conventions-android/.github/actions/setup-gradle@v0.13.1 @@ -40,12 +32,8 @@ jobs: permissions: contents: read pull-requests: read - contents: read - pull-requests: read name: Rubocop runs-on: ubuntu-22.04 - contents: read - pull-requests: read steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - uses: GetStream/android-ci-actions/actions/setup-ruby@main From 6643b09a5b298f8c4a490fab9ef47799aa9c6fc1 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:43 +0200 Subject: [PATCH 56/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/publish-new-version.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/publish-new-version.yml b/.github/workflows/publish-new-version.yml index d14c6ff02af..07e8e1b7d63 100644 --- a/.github/workflows/publish-new-version.yml +++ b/.github/workflows/publish-new-version.yml @@ -26,18 +26,15 @@ jobs: pre_release_check: permissions: contents: read - contents: read name: Pre release check runs-on: ubuntu-24.04 environment: 'publish' - contents: read steps: - name: Check id: pre_release_check_step run: echo "Pre release check" publish: permissions: - contents: read contents: read contents: write needs: pre_release_check From 5920afd3119820943b2bf03797c672077f9186a5 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:44 +0200 Subject: [PATCH 57/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/sdk-size-updates.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/sdk-size-updates.yml b/.github/workflows/sdk-size-updates.yml index 894c54b85fb..c1a4fcc389d 100644 --- a/.github/workflows/sdk-size-updates.yml +++ b/.github/workflows/sdk-size-updates.yml @@ -14,9 +14,7 @@ jobs: update-sdk-sizes: permissions: contents: read - contents: read uses: GetStream/stream-build-conventions-android/.github/workflows/sdk-size-updates.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 - pull-requests: write with: modules: "stream-chat-android-client stream-chat-android-ui-components stream-chat-android-compose" metrics-project: "stream-chat-android-metrics" From 51762c441230b7dae2b5c8ebb0d278f4c90ae65a Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 16:45:46 +0200 Subject: [PATCH 58/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/snapshot-test.yaml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/snapshot-test.yaml b/.github/workflows/snapshot-test.yaml index 2305b6e346a..87eb6d33e9c 100644 --- a/.github/workflows/snapshot-test.yaml +++ b/.github/workflows/snapshot-test.yaml @@ -20,13 +20,8 @@ jobs: actions: write contents: read pull-requests: write - actions: write - contents: read - pull-requests: write name: Run runs-on: ubuntu-24.04 - contents: read - pull-requests: read steps: - name: Check out code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 From e28ef48d40d99355cca16f0e8f5384b897f8ba15 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:44:43 +0200 Subject: [PATCH 59/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/apk-s3-distribute.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/apk-s3-distribute.yml b/.github/workflows/apk-s3-distribute.yml index af63b0098cd..92e0535e232 100644 --- a/.github/workflows/apk-s3-distribute.yml +++ b/.github/workflows/apk-s3-distribute.yml @@ -5,6 +5,7 @@ on: workflows: ["ReleasePost", "PublishHotfix"] types: - completed + jobs: build_ui_components_sample_app: permissions: From 8894c4f181017f7308400d36788a3e56a9c5580f Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:44:44 +0200 Subject: [PATCH 60/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/app-distribute-v7.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/app-distribute-v7.yml b/.github/workflows/app-distribute-v7.yml index a97f329e2cc..aad910b0604 100644 --- a/.github/workflows/app-distribute-v7.yml +++ b/.github/workflows/app-distribute-v7.yml @@ -8,6 +8,7 @@ on: branches: - v7 workflow_dispatch: + jobs: build_compose_sample_app: permissions: From 8f49b35fd4c66a4df19b4199ce1b3537e967c328 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:44:46 +0200 Subject: [PATCH 61/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/app-distribute.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/app-distribute.yml b/.github/workflows/app-distribute.yml index f70d39f7233..bcd449f9e3d 100644 --- a/.github/workflows/app-distribute.yml +++ b/.github/workflows/app-distribute.yml @@ -5,6 +5,7 @@ on: branches: - develop - main + jobs: build_ui_components_sample_app: permissions: From 31c610bccd4f143fe7c5b5942cc7d100bd20cffb Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:44:47 +0200 Subject: [PATCH 62/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/build-and-test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 70886876600..effc6e670da 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -9,6 +9,7 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true + jobs: debug_build: permissions: From 10172bca99a35d1d6353ba8ed4c2a8e1827cf88d Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:44:48 +0200 Subject: [PATCH 63/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/clean-detekt-baseline.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/clean-detekt-baseline.yaml b/.github/workflows/clean-detekt-baseline.yaml index 275bf388083..5a3a6fe7030 100644 --- a/.github/workflows/clean-detekt-baseline.yaml +++ b/.github/workflows/clean-detekt-baseline.yaml @@ -4,6 +4,7 @@ on: schedule: # Every midnight - cron: "0 0 * * *" + jobs: clean_detekt_baseline_files: permissions: From cd9124c7e023ef1d359ad2e1eb8247582ed198d2 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:44:50 +0200 Subject: [PATCH 64/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/e2e-build.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/e2e-build.yml b/.github/workflows/e2e-build.yml index 42ebe48541f..fd29d80aea6 100644 --- a/.github/workflows/e2e-build.yml +++ b/.github/workflows/e2e-build.yml @@ -12,6 +12,7 @@ env: BUILD_CACHE_AWS_BUCKET: ${{ secrets.BUILD_CACHE_AWS_BUCKET }} BUILD_CACHE_AWS_ACCESS_KEY_ID: ${{ secrets.BUILD_CACHE_AWS_ACCESS_KEY_ID }} BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} + jobs: build: permissions: From 251e555a629a73b288812e23a1ba5aae9187f26b Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:44:51 +0200 Subject: [PATCH 65/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/e2e-test-backend.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/e2e-test-backend.yml b/.github/workflows/e2e-test-backend.yml index fe2c930a2ac..c12fdfb429f 100644 --- a/.github/workflows/e2e-test-backend.yml +++ b/.github/workflows/e2e-test-backend.yml @@ -9,6 +9,7 @@ env: BUILD_CACHE_AWS_ACCESS_KEY_ID: ${{ secrets.BUILD_CACHE_AWS_ACCESS_KEY_ID }} BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + jobs: test-backend-integration: permissions: From 20d75a9e074de47c68721dac2887acb384bc3977 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:44:53 +0200 Subject: [PATCH 66/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/e2e-test-cron.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/e2e-test-cron.yml b/.github/workflows/e2e-test-cron.yml index 4a3c6f2b1e6..04e11dfb64c 100644 --- a/.github/workflows/e2e-test-cron.yml +++ b/.github/workflows/e2e-test-cron.yml @@ -23,6 +23,7 @@ env: BUILD_CACHE_AWS_ACCESS_KEY_ID: ${{ secrets.BUILD_CACHE_AWS_ACCESS_KEY_ID }} BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + jobs: build-compose-apks: permissions: From f36a1c489a063ac74db3ffa9332b343e8c8de2f2 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:44:54 +0200 Subject: [PATCH 67/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/e2e-test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml index 793ee258c5a..9fcdd91e79a 100644 --- a/.github/workflows/e2e-test.yml +++ b/.github/workflows/e2e-test.yml @@ -22,6 +22,7 @@ env: BUILD_CACHE_AWS_SECRET_KEY: ${{ secrets.BUILD_CACHE_AWS_SECRET_KEY }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_PR_NUM: ${{ github.event.pull_request.number }} + jobs: build-compose-apks: permissions: From 245ddb9ce2f9338ddd83e927edc7d830524d98fb Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:44:55 +0200 Subject: [PATCH 68/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/no-response.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml index 016ac6d49cc..14f27c30aed 100644 --- a/.github/workflows/no-response.yml +++ b/.github/workflows/no-response.yml @@ -6,6 +6,7 @@ on: schedule: # Every midnight - cron: '0 0 * * *' + jobs: noResponse: permissions: From bd6c01a084382b407dce7ecd22a896832a64f8e1 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:44:57 +0200 Subject: [PATCH 69/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/pr-checks.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 88d3acd3153..43ad069543c 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -5,6 +5,7 @@ on: [ pull_request ] concurrency: group: ${{ github.head_ref }} cancel-in-progress: true + jobs: base-android-ci: permissions: From a3b3f6708ecb87ad29c9ebd620ffcce5cc96da3f Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:44:58 +0200 Subject: [PATCH 70/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/publish-new-version.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-new-version.yml b/.github/workflows/publish-new-version.yml index 07e8e1b7d63..d239c296263 100644 --- a/.github/workflows/publish-new-version.yml +++ b/.github/workflows/publish-new-version.yml @@ -22,6 +22,7 @@ on: concurrency: group: release cancel-in-progress: false + jobs: pre_release_check: permissions: @@ -35,7 +36,6 @@ jobs: run: echo "Pre release check" publish: permissions: - contents: read contents: write needs: pre_release_check uses: GetStream/stream-build-conventions-android/.github/workflows/release.yml@8c5fbade4ee9c06a0a979bcb0866e64669254f73 From c4d3c2d28a1c61eda10f5200cdc62f28cb772169 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:45:00 +0200 Subject: [PATCH 71/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/sdk-size-updates.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/sdk-size-updates.yml b/.github/workflows/sdk-size-updates.yml index c1a4fcc389d..eabba3c7049 100644 --- a/.github/workflows/sdk-size-updates.yml +++ b/.github/workflows/sdk-size-updates.yml @@ -10,6 +10,7 @@ on: concurrency: group: ${{ github.workflow }} cancel-in-progress: true + jobs: update-sdk-sizes: permissions: From dc18d443b696376ddebb4c81e9c031b2a84351bb Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 18:45:01 +0200 Subject: [PATCH 72/73] ci: repair workflow permissions blocks for actionlint/SonarCloud --- .github/workflows/snapshot-test.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/snapshot-test.yaml b/.github/workflows/snapshot-test.yaml index 87eb6d33e9c..f973fae20de 100644 --- a/.github/workflows/snapshot-test.yaml +++ b/.github/workflows/snapshot-test.yaml @@ -14,6 +14,7 @@ on: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_PR_NUM: ${{ github.event.pull_request.number }} + jobs: run_snapshot_tests: permissions: From f7c57c1a42dbab0ff0b67eec2799b91fdf438875 Mon Sep 17 00:00:00 2001 From: Gian <47775302+gpunto@users.noreply.github.com> Date: Thu, 9 Jul 2026 14:00:46 +0200 Subject: [PATCH 73/73] ci: allow snapshot record job to push branch (contents: write) --- .github/workflows/snapshot-test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/snapshot-test.yaml b/.github/workflows/snapshot-test.yaml index f973fae20de..ad3b2aa0e8e 100644 --- a/.github/workflows/snapshot-test.yaml +++ b/.github/workflows/snapshot-test.yaml @@ -19,7 +19,7 @@ jobs: run_snapshot_tests: permissions: actions: write - contents: read + contents: write pull-requests: write name: Run runs-on: ubuntu-24.04