Update github actions (based on SDMSE) and use pinning

2026-09-14 18:26:11 -04:00 · 2025-04-11 03:02:23 +02:00
parent e216fbf66e
commit 2352974d4d
5 changed files with 112 additions and 54 deletions
@@ -0,0 +1,42 @@
+name: 'Common project setup'
+description: 'Setup the base project'
+runs:
+  using: "composite"
+  steps:
+    - name: Set up JDK 17
+      uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 #v4.7.0
+      with:
+        java-version: '17'
+        distribution: 'temurin'
+
+    - name: Grant execute permission for gradlew
+      shell: bash
+      run: chmod +x gradlew
+
+    - name: Cache Gradle Wrapper
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
+      with:
+        path: |
+          ~/.gradle/wrapper
+          !~/.gradle/wrapper/dists/**/gradle*.zip
+        key: ${{ runner.os }}-gradle-wrapper-${{ hashFiles('**/gradle-wrapper.properties') }}
+        restore-keys: |
+          ${{ runner.os }}-gradle-wrapper-
+
+    - name: Cache Gradle Dependencies
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
+      with:
+        path: |
+          ~/.gradle/caches
+        key: ${{ runner.os }}-gradle-caches-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'buildSrc/**/*.kt') }}
+        restore-keys: |
+          ${{ runner.os }}-gradle-caches-
+
+    - name: Cache Android Global Build-Cache
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
+      with:
+        path: |
+          ~/.android/build-cache
+        key: ${{ runner.os }}-android-build-cache-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+        restore-keys: |
+          ${{ runner.os }}-android-build-cache-
@@ -0,0 +1,14 @@
+changelog:
+  exclude:
+    labels:
+      - changelog-ignore
+  categories:
+    - title: ":rocket: Enhancements"
+      labels:
+        - enhancement
+    - title: ":lady_beetle: Bug fixes"
+      labels:
+        - bug
+    - title: ":shrug: Other changes"
+      labels:
+        - "*"
@@ -7,6 +7,24 @@ on:
    branches: [ main ]

 jobs:
+  lint-vital:
+    name: Lint vitals
+    strategy:
+      fail-fast: false
+      matrix:
+        flavor: [ Foss,Gplay ]
+        variant: [ Beta,Release ]
+        module: [ app ]
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+      - name: Setup project and build environment
+        uses: ./.github/actions/common-setup
+
+      - name: Check for fatal lint issues
+        run: ./gradlew lintVital${{ matrix.flavor }}${{ matrix.variant }}
+
  build-modules:
    name: Build apps
    strategy:
@@ -14,20 +32,15 @@ jobs:
      matrix:
        flavor: [ Foss,Gplay ]
        variant: [ Debug ]
-        module: [ app,app-wear ]
-    runs-on: ubuntu-latest
+        module: [ app ]
+    runs-on: ubuntu-22.04
    steps:
-      - uses: actions/checkout@v3
-      - name: Set up JDK 17
-        uses: actions/setup-java@v3
-        with:
-          java-version: '17'
-          distribution: 'adopt'
-          cache: gradle
-      - name: Grant execute permission for gradlew
-        run: chmod +x gradlew
+      - name: Checkout source code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+      - name: Setup project and build environment
+        uses: ./.github/actions/common-setup

-      - name: Build module
+      - name: Build modules
        run: ./gradlew ${{ matrix.module }}:assemble${{ matrix.flavor }}${{ matrix.variant }}

  test-modules:
@@ -35,19 +48,14 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        variant: [ Release ]
-        flavor: [ testFoss,testGplay ]
-    runs-on: ubuntu-latest
+        variant: [ Debug,Beta,Release ]
+        flavor: [ test,testFoss,testGplay ]
+    runs-on: ubuntu-22.04
    steps:
-      - uses: actions/checkout@v3
-      - name: Set up JDK 17
-        uses: actions/setup-java@v3
-        with:
-          java-version: '17'
-          distribution: 'adopt'
-          cache: gradle
-      - name: Grant execute permission for gradlew
-        run: chmod +x gradlew
+      - name: Checkout source code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+      - name: Setup project and build environment
+        uses: ./.github/actions/common-setup

      - name: Test modules
        run: ./gradlew ${{ matrix.flavor }}${{ matrix.variant }}UnitTest
@@ -11,7 +11,7 @@ on:
 jobs:
  validation:
    name: "Validation"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
    steps:
-      - uses: actions/checkout@v2
-      - uses: gradle/wrapper-validation-action@v1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+      - uses: gradle/actions/wrapper-validation@06832c7b30a0129d7fb559bcc6e43d26f6374244 #v4.3.1
@@ -8,7 +8,9 @@ on:
 jobs:
  release-github:
    name: Create GitHub release
-    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    runs-on: ubuntu-22.04
    environment: foss-production
    steps:
      - name: Decode Keystore
@@ -21,25 +23,22 @@ jobs:
          echo $ENCODED_KEYSTORE | base64 -di > "${TMP_KEYSTORE_FILE_PATH}"
          echo "STORE_PATH=$(echo $TMP_KEYSTORE_FILE_PATH)" >> $GITHUB_ENV

-      - name: Checkout
-        uses: actions/checkout@v3
+      - name: Checkout source code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
        with:
          fetch-depth: 0

+      - name: Setup project and build environment
+        uses: ./.github/actions/common-setup
+
      - name: Get the version
        id: tagger
-        uses: jimschubert/query-tag-action@v2
+        uses: jimschubert/query-tag-action@0b288a5fff630fea2e96d61b99047ed823ca19dc #v2.2
        with:
          skip-unshallow: 'true'
          abbrev: false
          commit-ish: HEAD

-      - name: Install JDK ${{ matrix.java_version }}
-        uses: actions/setup-java@v3
-        with:
-          distribution: 'adopt'
-          java-version: 17
-
      - name: Assemble beta APK
        if: contains(steps.tagger.outputs.tag, '-beta')
        run: ./gradlew assembleFossBeta
@@ -60,7 +59,7 @@ jobs:

      - name: Create pre-release
        if: contains(steps.tagger.outputs.tag, '-beta')
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda #v2.2.1
        with:
          prerelease: true
          tag_name: ${{ steps.tagger.outputs.tag }}
@@ -74,21 +73,19 @@ jobs:

      - name: Create release
        if: "!contains(steps.tagger.outputs.tag, '-beta')"
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda #v2.2.1
        with:
          prerelease: false
          tag_name: ${{ steps.tagger.outputs.tag }}
          name: ${{ steps.tagger.outputs.tag }}
          generate_release_notes: true
-          files: |
-            app/build/outputs/apk/foss/release/*.apk
-            app-wear/build/outputs/apk/foss/release/*.apk
+          files: app/build/outputs/apk/foss/release/*.apk
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  release-gplay:
    name: Create Google Play release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
    environment: gplay-production
    steps:
      - name: Decode Keystore
@@ -111,29 +108,26 @@ jobs:
          echo $ENCODED_SERVICE_KEY | base64 -di > "${TMP_SERVICEKEY_FILE_PATH}"
          echo "SUPPLY_JSON_KEY=$(echo $TMP_SERVICEKEY_FILE_PATH)" >> $GITHUB_ENV

-      - name: Checkout
-        uses: actions/checkout@v3
+      - name: Checkout source code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
        with:
          fetch-depth: 0

+      - name: Setup project and build environment
+        uses: ./.github/actions/common-setup
+
      - name: Get the version
        id: tagger
-        uses: jimschubert/query-tag-action@v2
+        uses: jimschubert/query-tag-action@0b288a5fff630fea2e96d61b99047ed823ca19dc #v2.2
        with:
          skip-unshallow: 'true'
          abbrev: false
          commit-ish: HEAD

-      - name: Install JDK ${{ matrix.java_version }}
-        uses: actions/setup-java@v3
-        with:
-          distribution: 'adopt'
-          java-version: 17
-
      - name: Set up ruby env
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 #v1.229.0
        with:
-          ruby-version: 2.7.6
+          ruby-version: 3.3.6
          bundler-cache: true

      #      - name: Assemble WearOS beta and upload to Google Play