Merge pull request #2594 from nextcloud/repo-sync/android-config/main

🔄 synced file(s) with nextcloud/android-config

Author: AndyScherzinger

.github/workflows/analysis.yml

@@ -1,9 +1,11 @@
 # synced from @nextcloud/android-config
 
 # SPDX-FileCopyrightText: 2023-2024 Nextcloud GmbH and Nextcloud contributors
+# SPDX-FileCopyrightText: 2025 Alper Ozturk <[email protected]>
 # SPDX-FileCopyrightText: 2023 Tobias Kaminsky <[email protected]>
 # SPDX-FileCopyrightText: 2023 Andy Scherzinger <[email protected]>
 # SPDX-FileCopyrightText: 2023 Josh Richards <[email protected]>
+# SPDX-FileCopyrightText: 2025 Marcel Hibbe <[email protected]>
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 name: "Analysis"
@@ -24,9 +26,14 @@ concurrency:
 
 jobs:
     analysis:
-        runs-on: ubuntu-24.04
+        runs-on: ubuntu-latest
         steps:
-            -   name: Setup variables
+            - name: Disabled on forks
+              if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+              run: |
+                  echo 'Can not analyze PRs from forks'
+                  exit 1
+            -   name: Setup variables # zizmor: ignore[template-injection]
                 id: get-vars
                 run: |
                     if [ -z "$GITHUB_HEAD_REF" ]; then
@@ -46,6 +53,7 @@ jobs:
                     fi
             -   uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
                 with:
+                    persist-credentials: false
                     repository: ${{ steps.get-vars.outputs.repo }}
                     ref: ${{ steps.get-vars.outputs.branch }}
             -   name: Set up JDK 17
@@ -61,9 +69,11 @@ jobs:
                     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                 run: |
                     mkdir -p "$HOME/.gradle"
-                    echo "org.gradle.jvmargs=-Xmx6g -XX:+HeapDumpOnOutOfMemoryError -Dfile.encoding=UTF-8 -XX:+UseParallelGC -XX:MaxMetaspaceSize=1g" > "$HOME/.gradle/gradle.properties"
-                    echo "org.gradle.caching=true" >> $HOME/.gradle/gradle.properties
-                    echo "org.gradle.parallel=true" >> $HOME/.gradle/gradle.properties
-                    echo "org.gradle.configureondemand=true" >> $HOME/.gradle/gradle.properties
-                    echo "kapt.incremental.apt=true" >> $HOME/.gradle/gradle.properties
-                    scripts/analysis/analysis-wrapper.sh ${{ steps.get-vars.outputs.branch }} ${{ secrets.LOG_USERNAME }} ${{ secrets.LOG_PASSWORD }} "$GITHUB_RUN_NUMBER" ${{ steps.get-vars.outputs.pr }}
+                    {
+                        echo "org.gradle.jvmargs=-Xmx6g -XX:+HeapDumpOnOutOfMemoryError -Dfile.encoding=UTF-8 -XX:+UseParallelGC -XX:MaxMetaspaceSize=1g"
+                        echo "org.gradle.caching=true"
+                        echo "org.gradle.parallel=true"
+                        echo "org.gradle.configureondemand=true"
+                        echo "kapt.incremental.apt=true"
+                    } > "$HOME/.gradle/gradle.properties"
+                    scripts/analysis/analysis-wrapper.sh "${{ steps.get-vars.outputs.branch }}" "${{ secrets.LOG_USERNAME }}" "${{ secrets.LOG_PASSWORD }}" "$GITHUB_RUN_NUMBER" "${{ steps.get-vars.outputs.pr }}"

.github/workflows/autoApproveSync.yml

@@ -6,7 +6,7 @@
 
 name: Auto approve sync
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     branches:
       - master
       - main

.github/workflows/codeql.yml

@@ -4,6 +4,7 @@
 # SPDX-FileCopyrightText: 2023-2024 Andy Scherzinger <[email protected]>
 # SPDX-FileCopyrightText: 2022 Tobias Kaminsky <[email protected]>
 # SPDX-FileCopyrightText: 2022 Álvaro Brey <[email protected]>
+# SPDX-FileCopyrightText: 2025 Marcel Hibbe <[email protected]>
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 name: "CodeQL"
@@ -22,7 +23,7 @@ permissions:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
@@ -34,12 +35,15 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Set Swap Space
+        if: runner.environment == 'github-hosted'
         uses: pierotofy/set-swap-space@49819abfb41bd9b44fb781159c033dba90353a7c # v1.0
         with:
           swap-size-gb: 10
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+        uses: github/codeql-action/init@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12
         with:
           languages: ${{ matrix.language }}
       - name: Set up JDK 17
@@ -53,4 +57,4 @@ jobs:
           echo "org.gradle.jvmargs=-Xmx4g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError" > "$HOME/.gradle/gradle.properties"
           ./gradlew assembleDebug
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+        uses: github/codeql-action/analyze@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12

.github/workflows/pr-feedback.yml

@@ -36,7 +36,7 @@ jobs:
           blocklist=$(curl https://raw.githubusercontent.com/nextcloud/.github/master/non-community-usernames.txt | paste -s -d, -)
           echo "blocklist=$blocklist" >> "$GITHUB_OUTPUT"
 
-      - uses: marcelklehr/pr-feedback-action@1883b38a033fb16f576875e0cf45f98b857655c4
+      - uses: nextcloud/pr-feedback-action@1883b38a033fb16f576875e0cf45f98b857655c4 # main
         with:
           feedback-message: |
             Hello there,

.github/workflows/renovate-approve-merge.yml

@@ -9,7 +9,7 @@
 name: Auto approve renovate PRs
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     branches:
       - main
       - master
@@ -24,7 +24,7 @@ concurrency:
 
 jobs:
   auto-approve-merge:
-    if: github.actor == 'renovate[bot]'
+    if: github.event.pull_request.user.login == 'renovate[bot]'
     runs-on: ubuntu-latest
     permissions:
       # for hmarr/auto-approve-action to approve PRs
@@ -52,7 +52,7 @@ jobs:
 
       # Enable GitHub auto merge
       - name: Auto merge
-        uses: alexwilson/enable-github-automerge-action@main
+        uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # v2.0.0
         if: startsWith(steps.branchname.outputs.branch, 'renovate/')
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/scorecard.yml

@@ -42,6 +42,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+        uses: github/codeql-action/upload-sarif@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12
         with:
           sarif_file: results.sarif