From f4f1078c809fab29eb09de880de8d98514c5a51a Mon Sep 17 00:00:00 2001 From: Emma Date: Fri, 24 Jul 2026 11:26:14 +0300 Subject: [PATCH 1/3] =?UTF-8?q?Korjaa=20Dependabot-p=C3=A4ivitysten=20CI-t?= =?UTF-8?q?arkistukset?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/dependabot.yml | 4 ++++ .github/workflows/codeql.yml | 12 ++++++++---- .github/workflows/lint.yml | 6 ++++-- .github/workflows/qodana.yml | 3 ++- .github/workflows/release-build.yml | 6 ++++-- .github/workflows/security.yml | 6 ++++-- .github/workflows/sonar.yml | 5 +++-- 7 files changed, 29 insertions(+), 13 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1ef608f..530e2c0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,6 +8,10 @@ updates: directory: "/" schedule: interval: "weekly" + groups: + codeql-action: + patterns: + - "github/codeql-action/*" - package-ecosystem: "npm" directory: "/.deepsec" schedule: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 17fd645..93ca4b6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -21,10 +21,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3. + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1. + with: + persist-credentials: false - name: Set up JDK 21 - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0. + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.6.0. with: java-version: '21' distribution: 'temurin' @@ -35,15 +37,17 @@ jobs: packages: platform-tools platforms;android-37.0 - name: Initialize CodeQL - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # Lukittu versioon v4.37.0. + uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.3. with: languages: java-kotlin build-mode: manual + # CodeQL 2.26.1 ei tue Kotlin 2.4.10:tä. Poista pin, kun vakaa bundle sisältää tuen. + tools: https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20260724/codeql-bundle-linux64.tar.zst - name: Build with Gradle run: ./gradlew assembleDebug --no-daemon - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # Lukittu versioon v4.37.0. + uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.3. with: category: "/language:java-kotlin" diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 8592ecb..32f0f37 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -17,10 +17,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3. + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1. + with: + persist-credentials: false - name: Set up JDK 21 - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0. + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.6.0. with: java-version: '21' distribution: 'temurin' diff --git a/.github/workflows/qodana.yml b/.github/workflows/qodana.yml index b219b6d..64d48a1 100644 --- a/.github/workflows/qodana.yml +++ b/.github/workflows/qodana.yml @@ -16,10 +16,11 @@ jobs: name: Qodana Analysis (non-blocking AGP 9.3 risk) runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3. + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1. with: ref: ${{ github.event.pull_request.head.sha || github.sha }} fetch-depth: 0 + persist-credentials: false - name: Qodana Scan uses: JetBrains/qodana-action@4861e015da555e86a72b862892aba6c2b93e6891 # Lukittu versioon v2026.1.3. diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml index 959b9c8..3604b3f 100644 --- a/.github/workflows/release-build.yml +++ b/.github/workflows/release-build.yml @@ -17,10 +17,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3. + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1. + with: + persist-credentials: false - name: Set up JDK 21 - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0. + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.6.0. with: java-version: '21' distribution: temurin diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 4f958c9..9da2cbb 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -21,7 +21,9 @@ jobs: container: image: semgrep/semgrep:1.162.0@sha256:9349edbadf90c3f3c0c3f55867625354e89680e6fa10d9034042af52fdb0e0d0 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3. + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1. + with: + persist-credentials: false - run: > semgrep scan --error @@ -35,7 +37,7 @@ jobs: --sarif --output semgrep.sarif . - - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.0. + - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.3. if: always() && hashFiles('semgrep.sarif') != '' with: sarif_file: semgrep.sarif diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index 03bb79c..0f76b74 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -16,12 +16,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3. + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1. with: fetch-depth: 0 + persist-credentials: false - name: Set up JDK 21 - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0. + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.6.0. with: java-version: '21' distribution: 'temurin' From 29626dae7b07d8179ca4366b1e792805d836ba42 Mon Sep 17 00:00:00 2001 From: Emma Date: Fri, 24 Jul 2026 11:36:27 +0300 Subject: [PATCH 2/3] Varmenna CodeQL-nightly ennen suoritusta --- .github/workflows/codeql.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 93ca4b6..6189b30 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,6 +18,10 @@ jobs: name: Analyze (Java/Kotlin) runs-on: ubuntu-latest timeout-minutes: 360 + env: + CODEQL_BUNDLE_PATH: ${{ runner.temp }}/codeql-bundle-20260724-linux64.tar.zst + CODEQL_BUNDLE_SHA256: 5bbf89fc9e818dbb45502c6697fe5806a17b868fba802f6e27e91110f84036b5 + CODEQL_BUNDLE_URL: https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20260724/codeql-bundle-linux64.tar.zst steps: - name: Checkout repository @@ -36,13 +40,19 @@ jobs: with: packages: platform-tools platforms;android-37.0 + - name: Download verified CodeQL bundle + shell: bash + run: | + curl --fail --location --retry 3 --output "$CODEQL_BUNDLE_PATH" "$CODEQL_BUNDLE_URL" + echo "$CODEQL_BUNDLE_SHA256 $CODEQL_BUNDLE_PATH" | sha256sum --check --strict + - name: Initialize CodeQL uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.3. with: languages: java-kotlin build-mode: manual # CodeQL 2.26.1 ei tue Kotlin 2.4.10:tä. Poista pin, kun vakaa bundle sisältää tuen. - tools: https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20260724/codeql-bundle-linux64.tar.zst + tools: ${{ env.CODEQL_BUNDLE_PATH }} - name: Build with Gradle run: ./gradlew assembleDebug --no-daemon From c6caf97e39d18d8665c3dd427f17c7cf8a1a9e1b Mon Sep 17 00:00:00 2001 From: Emma Date: Fri, 24 Jul 2026 11:46:07 +0300 Subject: [PATCH 3/3] Korjaa CodeQL-bundlen latauspolku --- .github/workflows/codeql.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6189b30..983aa3a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,7 +19,6 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 360 env: - CODEQL_BUNDLE_PATH: ${{ runner.temp }}/codeql-bundle-20260724-linux64.tar.zst CODEQL_BUNDLE_SHA256: 5bbf89fc9e818dbb45502c6697fe5806a17b868fba802f6e27e91110f84036b5 CODEQL_BUNDLE_URL: https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20260724/codeql-bundle-linux64.tar.zst @@ -41,10 +40,13 @@ jobs: packages: platform-tools platforms;android-37.0 - name: Download verified CodeQL bundle + id: codeql-bundle shell: bash run: | - curl --fail --location --retry 3 --output "$CODEQL_BUNDLE_PATH" "$CODEQL_BUNDLE_URL" - echo "$CODEQL_BUNDLE_SHA256 $CODEQL_BUNDLE_PATH" | sha256sum --check --strict + bundle_path="$RUNNER_TEMP/codeql-bundle-20260724-linux64.tar.zst" + curl --proto '=https' --proto-redir '=https' --fail --location --retry 3 --output "$bundle_path" "$CODEQL_BUNDLE_URL" + echo "$CODEQL_BUNDLE_SHA256 $bundle_path" | sha256sum --check --strict + echo "path=$bundle_path" >> "$GITHUB_OUTPUT" - name: Initialize CodeQL uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.3. @@ -52,7 +54,7 @@ jobs: languages: java-kotlin build-mode: manual # CodeQL 2.26.1 ei tue Kotlin 2.4.10:tä. Poista pin, kun vakaa bundle sisältää tuen. - tools: ${{ env.CODEQL_BUNDLE_PATH }} + tools: ${{ steps.codeql-bundle.outputs.path }} - name: Build with Gradle run: ./gradlew assembleDebug --no-daemon