mirror of
https://github.com/greenart7c3/Amber.git
synced 2026-10-30 06:47:33 +00:00
greenart7c3
0c0e1139c8
create-release.yml granted contents: write to the whole workflow and actions/checkout persisted that token in .git/config, so every Gradle plugin and dependency in assembleRelease (and the daemon it left running into the signing step) could read a repo-write token. The build and signing now run in a read-only job without persisted credentials or a daemon and hand the APK over as an artifact; a separate release job, which builds nothing, gets contents: write to publish it. Pre-release detection uses the same bash rule as desktop-release.yml instead of a third-party action, and every other checkout drops persisted credentials too.
82 lines
2.9 KiB
YAML
82 lines
2.9 KiB
YAML
name: Check Offline Build Permissions
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [master]
|
|
push:
|
|
branches: [master]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
check-offline-permissions:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up JDK 21
|
|
uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
|
|
with:
|
|
distribution: 'temurin'
|
|
java-version: 21
|
|
|
|
- name: Cache Gradle
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
|
|
with:
|
|
path: |
|
|
~/.gradle/caches
|
|
~/.gradle/wrapper
|
|
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gradle-
|
|
|
|
- name: Create keystore.properties
|
|
run: touch keystore.properties
|
|
|
|
- name: Generate merged manifest for offline build
|
|
run: ./gradlew processOfflineDebugManifest --no-daemon
|
|
|
|
- name: Check for network permissions in offline merged manifest
|
|
run: |
|
|
MANIFEST=$(find app/build/intermediates/merged_manifests -name "AndroidManifest.xml" | grep -i offline | head -1)
|
|
if [ -z "$MANIFEST" ]; then
|
|
echo "ERROR: Could not find merged manifest for offline build"
|
|
exit 1
|
|
fi
|
|
echo "Checking: $MANIFEST"
|
|
FAILED=0
|
|
for PERMISSION in android.permission.INTERNET android.permission.CHANGE_NETWORK_STATE android.permission.ACCESS_NETWORK_STATE; do
|
|
if grep -q "$PERMISSION" "$MANIFEST"; then
|
|
echo ""
|
|
echo "ERROR: $PERMISSION found in offline build manifest!"
|
|
echo "The offline flavor must not include network permissions."
|
|
echo ""
|
|
echo "Offending lines:"
|
|
grep "$PERMISSION" "$MANIFEST"
|
|
FAILED=1
|
|
else
|
|
echo "OK: No $PERMISSION in offline build manifest"
|
|
fi
|
|
for COMPONENT in androidx.work.WorkManagerInitializer androidx.work.impl.background.systemjob.SystemJobService; do
|
|
if grep -q "$COMPONENT" "$MANIFEST"; then
|
|
echo ""
|
|
echo "ERROR: $COMPONENT found in offline build manifest!"
|
|
echo "WorkManager must never initialize in the offline flavor: it tracks"
|
|
echo "network-constrained work via ConnectivityManager, which crashes with"
|
|
echo "SecurityException because ACCESS_NETWORK_STATE is removed."
|
|
echo ""
|
|
echo "Offending lines:"
|
|
grep "$COMPONENT" "$MANIFEST"
|
|
FAILED=1
|
|
else
|
|
echo "OK: No $COMPONENT in offline build manifest"
|
|
fi
|
|
done
|
|
done
|
|
exit $FAILED
|