From b5e0853d2d27034a2e7aef17db9a27493676cb01 Mon Sep 17 00:00:00 2001 From: Chmouel Boudjnah Date: Wed, 29 Jul 2026 11:17:06 +0200 Subject: [PATCH] chore: make the build depend on less trust The wrapper downloaded Gradle from a URL and ran whatever came back, and every GitHub Action was pinned to a tag, which is a name someone else can move. Now the wrapper checks the distribution against a known checksum and each action is pinned to the commit it was when it was reviewed, with the tag kept alongside as a comment. CI also builds the release APK on every pull request. That is the build people install and the only one that runs R8, so a shrinking rule that strips something Readium needs should fail in review rather than on the evening a tag is cut. --- .github/workflows/build.yml | 18 +++++++++++++----- .github/workflows/release.yml | 6 +++--- gradle/wrapper/gradle-wrapper.properties | 1 + 3 files changed, 17 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 82d56bc6..4ed20fd4 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -11,16 +11,16 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: distribution: temurin java-version: "17" - name: Set up Gradle - uses: gradle/actions/setup-gradle@v6 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6 - name: Unit tests run: ./gradlew testDebugUnitTest --console=plain @@ -31,15 +31,23 @@ jobs: - name: Assemble debug APK run: ./gradlew assembleDebug --console=plain + # The release build is the one people install, and it is the only + # one that runs R8. Building it here means a rule that strips + # something Readium reflects on is caught in review, not on the + # evening a tag is cut. Unsigned without a keystore, which is fine: + # the point is that it builds and shrinks. + - name: Assemble release APK + run: ./gradlew assembleRelease --console=plain + - name: Upload debug APK - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: liseur-debug-apk path: app/build/outputs/apk/debug/*.apk - name: Upload test/lint reports if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: reports path: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 511c7634..931014b9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,18 +15,18 @@ jobs: timeout-minutes: 30 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: ref: ${{ github.event.release.tag_name }} - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: distribution: temurin java-version: "17" - name: Set up Gradle - uses: gradle/actions/setup-gradle@v6 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6 - name: Check release version env: diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties index a9db1155..dbe66e1d 100644 --- a/gradle/wrapper/gradle-wrapper.properties +++ b/gradle/wrapper/gradle-wrapper.properties @@ -1,5 +1,6 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists +distributionSha256Sum=9c0f7faeeb306cb14e4279a3e084ca6b596894089a0638e68a07c945a32c9e14 distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip networkTimeout=10000 retries=0