chore: make the build depend on less trust

The wrapper downloaded Gradle from a URL and ran whatever came back, and
every GitHub Action was pinned to a tag, which is a name someone else
can move. Now the wrapper checks the distribution against a known
checksum and each action is pinned to the commit it was when it was
reviewed, with the tag kept alongside as a comment.

CI also builds the release APK on every pull request. That is the build
people install and the only one that runs R8, so a shrinking rule that
strips something Readium needs should fail in review rather than on the
evening a tag is cut.

.github/workflows/build.yml

@@ -11,16 +11,16 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
         with:
           distribution: temurin
           java-version: "17"
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
 
       - name: Unit tests
         run: ./gradlew testDebugUnitTest --console=plain
@@ -31,15 +31,23 @@ jobs:
       - name: Assemble debug APK
         run: ./gradlew assembleDebug --console=plain
 
+      # The release build is the one people install, and it is the only
+      # one that runs R8. Building it here means a rule that strips
+      # something Readium reflects on is caught in review, not on the
+      # evening a tag is cut. Unsigned without a keystore, which is fine:
+      # the point is that it builds and shrinks.
+      - name: Assemble release APK
+        run: ./gradlew assembleRelease --console=plain
+
       - name: Upload debug APK
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: liseur-debug-apk
           path: app/build/outputs/apk/debug/*.apk
 
       - name: Upload test/lint reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: reports
           path: |

.github/workflows/release.yml

@@ -15,18 +15,18 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ github.event.release.tag_name }}
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
         with:
           distribution: temurin
           java-version: "17"
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
 
       - name: Check release version
         env:

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
+distributionSha256Sum=9c0f7faeeb306cb14e4279a3e084ca6b596894089a0638e68a07c945a32c9e14
 distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
 networkTimeout=10000
 retries=0