mirror of
https://github.com/d4rken-org/capod.git
synced 2026-09-15 02:36:12 -04:00
darken
b919d8d19b
Add explicit permissions and persist-credentials: false to all workflows. Without an explicit permissions block, GITHUB_TOKEN inherits the repo default (write-all). These CI workflows only need contents: read. The release workflow already declares contents: write at job level where needed. persist-credentials: false prevents the token from lingering in .git/config for subsequent steps, reducing attack surface if a third-party action is compromised.
81 lines
2.2 KiB
YAML
81 lines
2.2 KiB
YAML
name: Code tests & eval
|
|
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
pull_request:
|
|
branches: [ main ]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint-vital:
|
|
name: Lint vitals
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
flavor: [ Foss,Gplay ]
|
|
variant: [ Beta,Release ]
|
|
module: [ app ]
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout source code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
- name: Setup project and build environment
|
|
uses: ./.github/actions/common-setup
|
|
|
|
- name: Check for fatal lint issues
|
|
run: ./gradlew lintVital${{ matrix.flavor }}${{ matrix.variant }}
|
|
|
|
build-modules:
|
|
name: Build apps
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
flavor: [ Foss,Gplay ]
|
|
variant: [ Debug ]
|
|
module: [ app ]
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout source code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
- name: Setup project and build environment
|
|
uses: ./.github/actions/common-setup
|
|
|
|
- name: Build modules
|
|
run: ./gradlew ${{ matrix.module }}:assemble${{ matrix.flavor }}${{ matrix.variant }}
|
|
|
|
test-modules:
|
|
name: Unit tests
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
variant: [ Debug ]
|
|
flavor: [ testFoss,testGplay ]
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout source code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
- name: Setup project and build environment
|
|
uses: ./.github/actions/common-setup
|
|
|
|
- name: Test modules
|
|
run: ./gradlew ${{ matrix.flavor }}${{ matrix.variant }}UnitTest
|
|
|
|
check-fastlane-metadata:
|
|
name: Fastlane metadata
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout source code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
- name: Validate metadata lengths
|
|
run: bash fastlane/check_metadata_length.sh |