From 736d93288786e5d0da0b552d6e6cbcf5f2c9e7b7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 06:26:34 +0000 Subject: [PATCH] ci: bump the actions group across 1 directory with 7 updates Bumps the actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `5` | `7` | | [gradle/actions](https://github.com/gradle/actions) | `5` | `6` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` | | [actions/cache](https://github.com/actions/cache) | `4` | `6` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2` | `3` | | [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action) | `2` | `3` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4` | `5` | Updates `actions/checkout` from 5 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v5...v7) Updates `gradle/actions` from 5 to 6 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](https://github.com/gradle/actions/compare/v5...v6) Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v7) Updates `actions/cache` from 4 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/v4...v6) Updates `softprops/action-gh-release` from 2 to 3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/v2...v3) Updates `gitleaks/gitleaks-action` from 2 to 3 - [Release notes](https://github.com/gitleaks/gitleaks-action/releases) - [Commits](https://github.com/gitleaks/gitleaks-action/compare/v2...v3) Updates `actions/dependency-review-action` from 4 to 5 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/dependency-review-action dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: gitleaks/gitleaks-action dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: gradle/actions dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: softprops/action-gh-release dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 26 +++++++++++++------------- .github/workflows/release.yml | 8 ++++---- .github/workflows/security.yml | 10 +++++----- 3 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b7b087b..92b2ed4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,7 @@ jobs: timeout-minutes: 45 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Set up JDK 17 uses: actions/setup-java@v5 @@ -32,12 +32,12 @@ jobs: java-version: '17' - name: Set up Gradle - uses: gradle/actions/setup-gradle@v5 + uses: gradle/actions/setup-gradle@v6 with: cache-read-only: ${{ github.ref != 'refs/heads/main' }} - name: Validate Gradle wrapper - uses: gradle/actions/wrapper-validation@v5 + uses: gradle/actions/wrapper-validation@v6 - name: Unit tests run: ./gradlew testDebugUnitTest --stacktrace @@ -52,7 +52,7 @@ jobs: # them whatever the outcome. - name: Upload test reports if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: test-reports path: '**/build/reports/tests/**' @@ -61,7 +61,7 @@ jobs: - name: Upload lint reports if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: lint-reports path: '**/build/reports/lint-results-*.html' @@ -69,7 +69,7 @@ jobs: retention-days: 14 - name: Upload debug APKs - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: debug-apks path: '*/build/outputs/apk/debug/*.apk' @@ -82,7 +82,7 @@ jobs: timeout-minutes: 15 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Set up JDK 17 uses: actions/setup-java@v5 @@ -92,7 +92,7 @@ jobs: - name: Cache ktlint id: ktlint-cache - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ~/.cache/ktlint key: ktlint-${{ env.KTLINT_VERSION }} @@ -131,7 +131,7 @@ jobs: # every static check. This job installs the APKs on a real emulator and # asserts the process is still alive afterwards. steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Set up JDK 17 uses: actions/setup-java@v5 @@ -139,7 +139,7 @@ jobs: distribution: temurin java-version: '17' - - uses: gradle/actions/setup-gradle@v5 + - uses: gradle/actions/setup-gradle@v6 - name: Enable KVM run: | @@ -168,13 +168,13 @@ jobs: # per-machine ~/.android/debug.keystore, which silently makes every CI build # a different signer and breaks upgrades with INSTALL_FAILED_UPDATE_INCOMPATIBLE. steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Set up JDK 17 uses: actions/setup-java@v5 with: distribution: temurin java-version: '17' - - uses: gradle/actions/setup-gradle@v5 + - uses: gradle/actions/setup-gradle@v6 - name: Assemble and compare signers run: | @@ -203,7 +203,7 @@ jobs: timeout-minutes: 10 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 # docs/index.html is a single self-contained file served by GitHub Pages. # These are the failure modes that actually broke it before: a missing diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ba52a6e..846642b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ jobs: contents: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: ref: ${{ github.event.inputs.tag || github.ref }} @@ -31,8 +31,8 @@ jobs: distribution: temurin java-version: '17' - - uses: gradle/actions/setup-gradle@v5 - - uses: gradle/actions/wrapper-validation@v5 + - uses: gradle/actions/setup-gradle@v6 + - uses: gradle/actions/wrapper-validation@v6 # Never ship a tag that does not pass its own gate. - name: Verify @@ -54,7 +54,7 @@ jobs: echo "version=$version" >> "$GITHUB_OUTPUT" - name: Attach to release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 with: tag_name: ${{ github.event.inputs.tag || github.ref_name }} files: | diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 80fe47b..4549090 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -25,7 +25,7 @@ jobs: actions: read steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Set up JDK 17 uses: actions/setup-java@v5 @@ -54,13 +54,13 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: # Full history: a secret committed once and reverted is still leaked. fetch-depth: 0 - name: Gitleaks - uses: gitleaks/gitleaks-action@v2 + uses: gitleaks/gitleaks-action@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -71,8 +71,8 @@ jobs: # Only meaningful on a PR — it diffs the dependency graph against the base. if: github.event_name == 'pull_request' steps: - - uses: actions/checkout@v5 - - uses: actions/dependency-review-action@v4 + - uses: actions/checkout@v7 + - uses: actions/dependency-review-action@v5 with: fail-on-severity: high comment-summary-in-pr: always