Skip to content

[FIX] Fix problems in CI system#4815

Draft
jesmrec wants to merge 9 commits intomasterfrom
fix/changes_ci_security
Draft

[FIX] Fix problems in CI system#4815
jesmrec wants to merge 9 commits intomasterfrom
fix/changes_ci_security

Conversation

@jesmrec
Copy link
Copy Markdown
Collaborator

@jesmrec jesmrec commented Apr 6, 2026

Related Issues

App:

  • Add changelog files for the fixed issues in folder changelog/unreleased. More info here
  • Add feature to Release Notes in ReleaseNotesViewModel.kt creating a new ReleaseNote() with String resources (if required)

QA

@jesmrec jesmrec force-pushed the fix/changes_ci_security branch from 1de3b48 to 5252b05 Compare April 6, 2026 09:15
Copy link
Copy Markdown
Member

@DeepDiver1975 DeepDiver1975 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will review used actions tomorrow and add to the white list if necessary

steps:
- name: Checkout
uses: actions/checkout@v5
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should add the version as comment after the sha.
This will help dependabot to catch the right version when updating

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i will add commented versions to every new setup. Good tip, thanks.

@jesmrec jesmrec force-pushed the fix/changes_ci_security branch 4 times, most recently from 850942e to 8fc7ad8 Compare April 6, 2026 10:42
@jesmrec
Copy link
Copy Markdown
Collaborator Author

jesmrec commented Apr 6, 2026

These are the current broken actions:

  • reactivecircus/android-emulator-runner@4fe4b1ae376568ff65de774de6c0ca8070944022 #v2.37.0

It raises up an emulator: used for the instrumented tests, E2E tests and update tests

Ref: https://github.com/ReactiveCircus/android-emulator-runner


  • GuillaumeFalourd/git-commit-push@205c043bca2f932f7a48a28a8d619ba30eb84ba #v1.3

It commits the generated content in the workflow: used for calens and SBOM

Ref: https://github.com/GuillaumeFalourd/git-commit-push


  • dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 #v20

It fetchs the latest artifact generated by other workflow: used for update tests

Ref: https://github.com/dawidd6/action-download-artifact


Today's weirdest scenario:

toolhippie/calens:0.4.0@sha256:728ee4d17b6a3ec40f1a34363d56abbfe7c52f57b9cd6233ee34b82345ccc07f #v0.4.0

it seems to be whitelisted but, it does not work. Check here

@jesmrec jesmrec self-assigned this Apr 6, 2026
@jesmrec jesmrec force-pushed the fix/changes_ci_security branch from 6921dfb to 3c6f059 Compare April 6, 2026 12:11
@DeepDiver1975
Copy link
Copy Markdown
Member

DeepDiver1975 commented Apr 6, 2026

Try using the calens action and not the docker.
Currently the docker image is white listed but this does not work. The action should.....

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants