Release 2.15.3

.github/bump_versions_in_release_branch.sh

@@ -1,4 +1,5 @@
-#!/bin/bash
+#!/usr/bin/env bash
+set -euo pipefail
 
 # Check if the parameter is provided
 if [ $# -eq 0 ]; then
@@ -31,19 +32,22 @@ ls -l
 # Add changelog to the index and create a commit
 properties_file="gradle.properties"
 current_version=$(grep -E '^SDK_VERSION_NAME=' gradle.properties | cut -d'=' -f2)
-sed -i "s/^SDK_VERSION_NAME=.*/SDK_VERSION_NAME=$version/" $properties_file
-sed -i "s/^SDK_VERSION_NAME=.*/SDK_VERSION_NAME=$version/" $properties_file
+sed -i "s/^SDK_VERSION_NAME=.*/SDK_VERSION_NAME=$version/" "$properties_file"
 build_gradle_example_path="example/app/build.gradle"
-sed -i -E "s/cloud.mindbox:mobile-sdk:[0-9]+\.[0-9]+\.[0-9]+(-rc)?/cloud.mindbox:mobile-sdk:$version/" $build_gradle_example_path
+sed -i -E "s/cloud.mindbox:mobile-sdk:[0-9]+\.[0-9]+\.[0-9]+(-rc)?/cloud.mindbox:mobile-sdk:$version/" "$build_gradle_example_path"
 
 echo "Bump SDK version from $current_version to $version."
 
-git add $properties_file
-git add -f $build_gradle_example_path
-git commit -m "Bump SDK version to $version"
+git add "$properties_file"
+git add -f "$build_gradle_example_path"
+if git diff --cached --quiet; then
+    echo "Version is already $version — nothing to commit."
+else
+    git commit -m "Bump SDK version to $version"
+fi
 
 echo "Pushing changes to branch: $current_branch"
-if ! git push origin $current_branch; then
+if ! git push origin "$current_branch"; then
     echo "Failed to push changes to the origin $current_branch"
     exit 1
 fi

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 1
+    groups:
+      github-actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: "deps"
+      include: "scope"

.github/git-release-ci.sh

@@ -1,5 +1,5 @@
-#!/bin/bash
-set -e
+#!/usr/bin/env bash
+set -euo pipefail
 
 version=$(grep '^SDK_VERSION_NAME=' gradle.properties | cut -d '=' -f2)
 
@@ -8,7 +8,8 @@ if [[ $version == *"rc"* ]]; then
   is_beta=true
 fi
 
-branch=${GITHUB_REF#refs/heads/}
+branch=${RELEASE_BRANCH:-${GITHUB_REF:-}}
+branch=${branch#refs/heads/}
 
 echo "Version: $version"
 echo "Is Beta: $is_beta"
@@ -17,29 +18,32 @@ echo "Branch: $branch"
 echo "Fetching tags from remote repository."
 git fetch --tags
 
-if git rev-parse "$version" >/dev/null 2>&1; then
+if git rev-parse -q --verify "refs/tags/$version" >/dev/null; then
   echo "Local tag $version already exists."
 else
   echo "Creating local tag $version."
-  git tag $version
+  git tag "$version"
 fi
 
-if git ls-remote --tags origin | grep -q "refs/tags/$version"; then
+if [ -n "$(git ls-remote --tags origin "refs/tags/$version")" ]; then
   echo "Remote tag $version already exists."
 else
   echo "Pushing local tag $version to remote."
-  git push origin $version
+  git push origin "$version"
 fi
 
 # Create release
 release_title="Release $version"
-text="Autogenerated release. Check more details at [Mindbox SDK Documentation](https://developers.mindbox.ru/docs/androidhuawei-native-sdk)"
+text="Autogenerated release. Check more details at [Mindbox SDK Documentation](https://developers.mindbox.ru/docs/android-sdk)"
 
 echo "Release title: $release_title"
 echo "Text: $text"
 
-prerelease_flag=$([ "$is_beta" = true ] && echo "--prerelease" || echo "")
+release_args=("$version" --target "$branch" --title "$release_title" --notes "$text")
+if [ "$is_beta" = true ]; then
+  release_args+=(--prerelease)
+fi
 
-gh release create "$version" --target "$branch" --title "$release_title" --notes "$text" $prerelease_flag
+gh release create "${release_args[@]}"
 
 echo "Release $version created for repo on branch $branch"

.github/workflows/distribute-develop-mission.yml

@@ -8,10 +8,14 @@ on:
     types:
       - closed
 
+permissions:
+  contents: read
+
 jobs:
   call-reusable:
     if: ${{ github.event.pull_request.merged == true }}
     uses: ./.github/workflows/distribute-reusable.yml
     with:
       branch: ${{ github.base_ref }}
-    secrets: inherit 
+    secrets:
+      GITLAB_TRIGGER_TOKEN: ${{ secrets.GITLAB_TRIGGER_TOKEN }} 

.github/workflows/distribute-manual.yml

@@ -8,10 +8,14 @@ on:
         required: false
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   call-reusable:
     uses: ./.github/workflows/distribute-reusable.yml
     with:
       branch: ${{ github.ref_name }}
       app_ref: ${{ inputs.app_ref }}
-    secrets: inherit
+    secrets:
+      GITLAB_TRIGGER_TOKEN: ${{ secrets.GITLAB_TRIGGER_TOKEN }}

.github/workflows/distribute-release-support-mission.yml

@@ -10,10 +10,14 @@ on:
       - opened
       - synchronize
 
+permissions:
+  contents: read
+
 jobs:
   call-reusable:
     if: ${{ startsWith(github.event.pull_request.head.ref, 'release/') }}
     uses: ./.github/workflows/distribute-reusable.yml
-    secrets: inherit
+    secrets:
+      GITLAB_TRIGGER_TOKEN: ${{ secrets.GITLAB_TRIGGER_TOKEN }}
     with:
       branch: ${{ github.event.pull_request.head.ref }}

.github/workflows/distribute-reusable.yml

@@ -14,12 +14,15 @@ on:
       GITLAB_TRIGGER_TOKEN:
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   distribution:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.branch }}
           submodules: recursive
@@ -30,9 +33,12 @@ jobs:
         run: |
           set -euo pipefail
           commits="$(git log -3 --pretty=format:"%s")"
-          echo "commits<<EOF" >> "$GITHUB_ENV"
-          echo "$commits"     >> "$GITHUB_ENV"
-          echo "EOF"          >> "$GITHUB_ENV"
+          delim="EOF_$(openssl rand -hex 8)"
+          {
+            echo "commits<<$delim"
+            echo "$commits"
+            echo "$delim"
+          } >> "$GITHUB_ENV"
 
       - name: Debug payload that will be sent to GitLab
         shell: bash

.github/workflows/gitleaks-secrets-validate.yml

@@ -0,0 +1,23 @@
+name: Gitleaks Secrets Validate
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.MINDBOX_GITLEAKS_LICENSE }}

.github/workflows/lint_unitTests_build.yml

@@ -18,64 +18,86 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          fetch-depth: 2
+          fetch-depth: 0
           submodules: true
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: 'temurin'
           java-version: '17'
           cache: 'gradle'
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v2
+        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
 
       - name: Get changed Kotlin files
         id: get_changed_files
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+          HEAD_SHA: ${{ github.sha }}
         run: |
-            CHANGED_FILES=$(git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -E '\.kt$|\.kts$' || true)
+            set -euo pipefail
+            if [ -z "$BASE_SHA" ] || ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
+              echo "Base commit '$BASE_SHA' unavailable; falling back to ${HEAD_SHA}^"
+              BASE_SHA=$(git rev-parse "${HEAD_SHA}^")
+            fi
+            echo "Diff range: $BASE_SHA..$HEAD_SHA"
+            CHANGED_FILES=$(git diff --name-only --diff-filter=d "$BASE_SHA" "$HEAD_SHA" | { grep -E '\.kt$|\.kts$' || true; })
             echo "Changed Kotlin files:"
             echo "$CHANGED_FILES"
-            echo "CHANGED_FILES<<EOF" >> $GITHUB_OUTPUT
-            echo "$CHANGED_FILES" >> $GITHUB_OUTPUT
-            echo "EOF" >> $GITHUB_OUTPUT
+            DELIM="EOF_$(openssl rand -hex 8)"
+            {
+              echo "CHANGED_FILES<<$DELIM"
+              echo "$CHANGED_FILES"
+              echo "$DELIM"
+            } >> "$GITHUB_OUTPUT"
 
       - name: Run ktlintCheck on changed files
         if: steps.get_changed_files.outputs.CHANGED_FILES != ''
-        run: ./gradlew ktlintCheck -PinternalKtlintGitFilter="${{ steps.get_changed_files.outputs.CHANGED_FILES }}"
+        env:
+          CHANGED_FILES: ${{ steps.get_changed_files.outputs.CHANGED_FILES }}
+        run: ./gradlew ktlintCheck -PinternalKtlintGitFilter="$CHANGED_FILES"
 
       - name: lint check
         run: ./gradlew --no-daemon lintDebug
 
+      - name: detekt check
+        run: ./gradlew --no-daemon detektDebug
+
   unit:
-    runs-on: ubuntu-latest 
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: true
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: 'temurin'
           java-version: '17'
           cache: 'gradle'
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v2
+        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
 
       - name: unit tests with coverage
         run: ./gradlew --no-daemon --stacktrace testDebugUnitTest koverHtmlReport
 
       - name: test report
-        uses: asadmansr/android-test-report-action@v1.2.0
+        uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16 # v6.4.2
         if: ${{ always() }}
+        with:
+          report_paths: '**/build/test-results/testDebugUnitTest/TEST-*.xml'
+          fail_on_failure: true
+          detailed_summary: true
+          annotate_only: true
 
       - name: upload coverage report
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         if: github.ref == 'refs/heads/develop'
         with:
           path: build/reports/kover/html
@@ -93,17 +115,17 @@ jobs:
     steps:
       - name: deploy to GitHub Pages
         id: deploy
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
 
   build:
     runs-on: ubuntu-latest 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: true
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: 'temurin'
           java-version: '17'