diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml index 951a1a2e4..5ee573650 100644 --- a/.github/workflows/analysis.yml +++ b/.github/workflows/analysis.yml @@ -1,9 +1,11 @@ # synced from @nextcloud/android-config # SPDX-FileCopyrightText: 2023-2024 Nextcloud GmbH and Nextcloud contributors +# SPDX-FileCopyrightText: 2025 Alper Ozturk # SPDX-FileCopyrightText: 2023 Tobias Kaminsky # SPDX-FileCopyrightText: 2023 Andy Scherzinger # SPDX-FileCopyrightText: 2023 Josh Richards +# SPDX-FileCopyrightText: 2025 Marcel Hibbe # SPDX-License-Identifier: GPL-3.0-or-later name: "Analysis" @@ -24,9 +26,14 @@ concurrency: jobs: analysis: - runs-on: ubuntu-24.04 + runs-on: ubuntu-latest steps: - - name: Setup variables + - name: Disabled on forks + if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} + run: | + echo 'Can not analyze PRs from forks' + exit 1 + - name: Setup variables # zizmor: ignore[template-injection] id: get-vars run: | if [ -z "$GITHUB_HEAD_REF" ]; then @@ -46,6 +53,7 @@ jobs: fi - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: + persist-credentials: false repository: ${{ steps.get-vars.outputs.repo }} ref: ${{ steps.get-vars.outputs.branch }} - name: Set up JDK 17 @@ -61,9 +69,11 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | mkdir -p "$HOME/.gradle" - echo "org.gradle.jvmargs=-Xmx6g -XX:+HeapDumpOnOutOfMemoryError -Dfile.encoding=UTF-8 -XX:+UseParallelGC -XX:MaxMetaspaceSize=1g" > "$HOME/.gradle/gradle.properties" - echo "org.gradle.caching=true" >> $HOME/.gradle/gradle.properties - echo "org.gradle.parallel=true" >> $HOME/.gradle/gradle.properties - echo "org.gradle.configureondemand=true" >> $HOME/.gradle/gradle.properties - echo "kapt.incremental.apt=true" >> $HOME/.gradle/gradle.properties - scripts/analysis/analysis-wrapper.sh ${{ steps.get-vars.outputs.branch }} ${{ secrets.LOG_USERNAME }} ${{ secrets.LOG_PASSWORD }} "$GITHUB_RUN_NUMBER" ${{ steps.get-vars.outputs.pr }} + { + echo "org.gradle.jvmargs=-Xmx6g -XX:+HeapDumpOnOutOfMemoryError -Dfile.encoding=UTF-8 -XX:+UseParallelGC -XX:MaxMetaspaceSize=1g" + echo "org.gradle.caching=true" + echo "org.gradle.parallel=true" + echo "org.gradle.configureondemand=true" + echo "kapt.incremental.apt=true" + } > "$HOME/.gradle/gradle.properties" + scripts/analysis/analysis-wrapper.sh "${{ steps.get-vars.outputs.branch }}" "${{ secrets.LOG_USERNAME }}" "${{ secrets.LOG_PASSWORD }}" "$GITHUB_RUN_NUMBER" "${{ steps.get-vars.outputs.pr }}" diff --git a/.github/workflows/autoApproveSync.yml b/.github/workflows/autoApproveSync.yml index 738cf4131..c215be0b3 100644 --- a/.github/workflows/autoApproveSync.yml +++ b/.github/workflows/autoApproveSync.yml @@ -6,7 +6,7 @@ name: Auto approve sync on: - pull_request_target: + pull_request_target: # zizmor: ignore[dangerous-triggers] branches: - master - main diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 48093b455..4f6a70afc 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -4,6 +4,7 @@ # SPDX-FileCopyrightText: 2023-2024 Andy Scherzinger # SPDX-FileCopyrightText: 2022 Tobias Kaminsky # SPDX-FileCopyrightText: 2022 Álvaro Brey +# SPDX-FileCopyrightText: 2025 Marcel Hibbe # SPDX-License-Identifier: GPL-3.0-or-later name: "CodeQL" @@ -22,7 +23,7 @@ permissions: jobs: analyze: name: Analyze - runs-on: ubuntu-24.04 + runs-on: ubuntu-latest permissions: actions: read contents: read @@ -34,12 +35,15 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set Swap Space + if: runner.environment == 'github-hosted' uses: pierotofy/set-swap-space@49819abfb41bd9b44fb781159c033dba90353a7c # v1.0 with: swap-size-gb: 10 - name: Initialize CodeQL - uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 + uses: github/codeql-action/init@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12 with: languages: ${{ matrix.language }} - name: Set up JDK 17 @@ -53,4 +57,4 @@ jobs: echo "org.gradle.jvmargs=-Xmx4g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError" > "$HOME/.gradle/gradle.properties" ./gradlew assembleDebug - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 + uses: github/codeql-action/analyze@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12 diff --git a/.github/workflows/pr-feedback.yml b/.github/workflows/pr-feedback.yml index 7d4966907..98e9fada7 100644 --- a/.github/workflows/pr-feedback.yml +++ b/.github/workflows/pr-feedback.yml @@ -36,7 +36,7 @@ jobs: blocklist=$(curl https://raw.githubusercontent.com/nextcloud/.github/master/non-community-usernames.txt | paste -s -d, -) echo "blocklist=$blocklist" >> "$GITHUB_OUTPUT" - - uses: marcelklehr/pr-feedback-action@1883b38a033fb16f576875e0cf45f98b857655c4 + - uses: nextcloud/pr-feedback-action@1883b38a033fb16f576875e0cf45f98b857655c4 # main with: feedback-message: | Hello there, diff --git a/.github/workflows/renovate-approve-merge.yml b/.github/workflows/renovate-approve-merge.yml index 48b98e91a..ccfed3974 100644 --- a/.github/workflows/renovate-approve-merge.yml +++ b/.github/workflows/renovate-approve-merge.yml @@ -9,7 +9,7 @@ name: Auto approve renovate PRs on: - pull_request_target: + pull_request_target: # zizmor: ignore[dangerous-triggers] branches: - main - master @@ -24,7 +24,7 @@ concurrency: jobs: auto-approve-merge: - if: github.actor == 'renovate[bot]' + if: github.event.pull_request.user.login == 'renovate[bot]' runs-on: ubuntu-latest permissions: # for hmarr/auto-approve-action to approve PRs @@ -52,7 +52,7 @@ jobs: # Enable GitHub auto merge - name: Auto merge - uses: alexwilson/enable-github-automerge-action@main + uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # v2.0.0 if: startsWith(steps.branchname.outputs.branch, 'renovate/') with: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 620a4c563..3b596e4f3 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -42,6 +42,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 + uses: github/codeql-action/upload-sarif@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12 with: sarif_file: results.sarif