From c94410b284a800710b3f927d03d207d75f433d67 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 06:24:39 +0000 Subject: [PATCH] ci: bump the actions group across 1 directory with 8 updates Bumps the actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `5` | `7` | | [actions/setup-java](https://github.com/actions/setup-java) | `5` | `6` | | [gradle/actions](https://github.com/gradle/actions) | `5` | `6` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` | | [actions/cache](https://github.com/actions/cache) | `4` | `6` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2` | `3` | | [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action) | `2` | `3` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4` | `5` | Updates `actions/checkout` from 5 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v5...v7) Updates `actions/setup-java` from 5 to 6 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/v5...v6) Updates `gradle/actions` from 5 to 6 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](https://github.com/gradle/actions/compare/v5...v6) Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v7) Updates `actions/cache` from 4 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/v4...v6) Updates `softprops/action-gh-release` from 2 to 3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/v2...v3) Updates `gitleaks/gitleaks-action` from 2 to 3 - [Release notes](https://github.com/gitleaks/gitleaks-action/releases) - [Commits](https://github.com/gitleaks/gitleaks-action/compare/v2...v3) Updates `actions/dependency-review-action` from 4 to 5 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-java dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: gradle/actions dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: softprops/action-gh-release dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: gitleaks/gitleaks-action dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/dependency-review-action dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 34 +++++++++++++++++----------------- .github/workflows/release.yml | 10 +++++----- .github/workflows/security.yml | 12 ++++++------ 3 files changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b7b087b..d294405 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,21 +23,21 @@ jobs: timeout-minutes: 45 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: '17' - name: Set up Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@v6 with: cache-read-only: ${{ github.ref != 'refs/heads/main' }} - name: Validate Gradle wrapper - uses: gradle/actions/wrapper-validation@v5 + uses: gradle/actions/wrapper-validation@v6 - name: Unit tests run: ./gradlew testDebugUnitTest --stacktrace @@ -52,7 +52,7 @@ jobs: # them whatever the outcome. - name: Upload test reports if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: test-reports path: '**/build/reports/tests/**' @@ -61,7 +61,7 @@ jobs: - name: Upload lint reports if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: lint-reports path: '**/build/reports/lint-results-*.html' @@ -69,7 +69,7 @@ jobs: retention-days: 14 - name: Upload debug APKs - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: debug-apks path: '*/build/outputs/apk/debug/*.apk' @@ -82,17 +82,17 @@ jobs: timeout-minutes: 15 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: '17' - name: Cache ktlint id: ktlint-cache - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ~/.cache/ktlint key: ktlint-${{ env.KTLINT_VERSION }} @@ -131,15 +131,15 @@ jobs: # every static check. This job installs the APKs on a real emulator and # asserts the process is still alive afterwards. steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: '17' - - uses: gradle/actions/setup-gradle@v5 + - uses: gradle/actions/setup-gradle@v6 - name: Enable KVM run: | @@ -168,13 +168,13 @@ jobs: # per-machine ~/.android/debug.keystore, which silently makes every CI build # a different signer and breaks upgrades with INSTALL_FAILED_UPDATE_INCOMPATIBLE. steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: '17' - - uses: gradle/actions/setup-gradle@v5 + - uses: gradle/actions/setup-gradle@v6 - name: Assemble and compare signers run: | @@ -203,7 +203,7 @@ jobs: timeout-minutes: 10 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 # docs/index.html is a single self-contained file served by GitHub Pages. # These are the failure modes that actually broke it before: a missing diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ba52a6e..eda7dc5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,18 +21,18 @@ jobs: contents: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: ref: ${{ github.event.inputs.tag || github.ref }} - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: '17' - - uses: gradle/actions/setup-gradle@v5 - - uses: gradle/actions/wrapper-validation@v5 + - uses: gradle/actions/setup-gradle@v6 + - uses: gradle/actions/wrapper-validation@v6 # Never ship a tag that does not pass its own gate. - name: Verify @@ -54,7 +54,7 @@ jobs: echo "version=$version" >> "$GITHUB_OUTPUT" - name: Attach to release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 with: tag_name: ${{ github.event.inputs.tag || github.ref_name }} files: | diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 80fe47b..8f36d9b 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -25,10 +25,10 @@ jobs: actions: read steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: '17' @@ -54,13 +54,13 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: # Full history: a secret committed once and reverted is still leaked. fetch-depth: 0 - name: Gitleaks - uses: gitleaks/gitleaks-action@v2 + uses: gitleaks/gitleaks-action@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -71,8 +71,8 @@ jobs: # Only meaningful on a PR — it diffs the dependency graph against the base. if: github.event_name == 'pull_request' steps: - - uses: actions/checkout@v5 - - uses: actions/dependency-review-action@v4 + - uses: actions/checkout@v7 + - uses: actions/dependency-review-action@v5 with: fail-on-severity: high comment-summary-in-pr: always