Skip to content

[FIX] Fix problems in CI system#4815

Merged
jesmrec merged 11 commits intomasterfrom
fix/changes_ci_security
Apr 7, 2026
Merged

[FIX] Fix problems in CI system#4815
jesmrec merged 11 commits intomasterfrom
fix/changes_ci_security

Conversation

@jesmrec
Copy link
Copy Markdown
Collaborator

@jesmrec jesmrec commented Apr 6, 2026 •
edited
Loading

Related Issues

App:

  • Add changelog files for the fixed issues in folder changelog/unreleased. More info here
  • Add feature to Release Notes in ReleaseNotesViewModel.kt creating a new ReleaseNote() with String resources (if required)

QA

@jesmrec jesmrec force-pushed the fix/changes_ci_security branch from 1de3b48 to 5252b05 Compare April 6, 2026 09:15
DeepDiver1975
DeepDiver1975 requested changes Apr 6, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@DeepDiver1975 DeepDiver1975 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will review used actions tomorrow and add to the white list if necessary

.github/workflows/android-instrumented-data-tests.yml Outdated
steps:
- name: Checkout
uses: actions/checkout@v5
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
Copy link
Copy Markdown
Member

@DeepDiver1975 DeepDiver1975 Apr 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should add the version as comment after the sha.
This will help dependabot to catch the right version when updating

Copy link
Copy Markdown
Collaborator Author

@jesmrec jesmrec Apr 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i will add commented versions to every new setup. Good tip, thanks.

@jesmrec jesmrec force-pushed the fix/changes_ci_security branch 4 times, most recently from 850942e to 8fc7ad8 Compare April 6, 2026 10:42
@jesmrec
Copy link
Copy Markdown
Collaborator Author

jesmrec commented Apr 6, 2026 •
edited
Loading

These are the current broken actions:

  • reactivecircus/android-emulator-runner@4fe4b1ae376568ff65de774de6c0ca8070944022 #v2.37.0

It raises up an emulator: used for the instrumented tests, E2E tests and update tests

Ref: https://github.com/ReactiveCircus/android-emulator-runner

  • GuillaumeFalourd/git-commit-push@205c043bca2f932f7a48a28a8d619ba30eb84ba #v1.3

It commits the generated content in the workflow: used for calens and SBOM

Ref: https://github.com/GuillaumeFalourd/git-commit-push

  • dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 #v20

It fetchs the latest artifact generated by other workflow: used for update tests

Ref: https://github.com/dawidd6/action-download-artifact

Today's weirdest scenario:

toolhippie/calens:0.4.0@sha256:728ee4d17b6a3ec40f1a34363d56abbfe7c52f57b9cd6233ee34b82345ccc07f #v0.4.0

it seems to be whitelisted but, it does not work. Check here

@jesmrec jesmrec self-assigned this Apr 6, 2026
@jesmrec jesmrec force-pushed the fix/changes_ci_security branch from 6921dfb to 3c6f059 Compare April 6, 2026 12:11
@DeepDiver1975
Copy link
Copy Markdown
Member

DeepDiver1975 commented Apr 6, 2026 •
edited
Loading

Try using the calens action and not the docker.
Currently the docker image is white listed but this does not work. The action should.....

@jesmrec
Copy link
Copy Markdown
Collaborator Author

jesmrec commented Apr 7, 2026

Try using the calens action and not the docker.
Currently the docker image is white listed but this does not work. The action should.....

@DeepDiver1975

i tried, but it did not work. I will set the action and wait for a possible whitelisting of the pending actions.

OTOH, This is the message:

The actions guillaumefalourd/git-commit-push@205c043bca2f932f7a48a28a8d619ba30eb84ba and toolhippie/calens:0.4.0@sha256:728ee4d17b6a3ec40f1a34363d56abbfe7c52f57b9cd6233ee34b82345ccc07f are not allowed in owncloud/android because all actions must be from a repository owned by owncloud, created by GitHub, verified in the GitHub Marketplace, or match one of the patterns: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50, amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825, peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e, peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0, shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f, softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe, toolhippie/calens:0.4.0@sha256:728ee4d17b6a3ec40f1a34363d56abbfe7c52f57b9cd6233ee34b82345ccc07f, transifex/cli-action@584fd205cbe598773b5a81ce711fa44842678189.

There, the toolhippie action is like:

toolhippie/calens:0.4.0@sha256:728ee4d17b6a3ec40f1a34363d56abbfe7c52f57b9cd6233ee34b82345ccc07f

is that correct? adding both version and the sha256?

@jesmrec jesmrec force-pushed the fix/changes_ci_security branch 2 times, most recently from b704b3a to 51bc49e Compare April 7, 2026 06:32
@DeepDiver1975
Copy link
Copy Markdown
Member

DeepDiver1975 commented Apr 7, 2026

There, the toolhippie action is like:

toolhippie/calens:0.4.0@sha256:728ee4d17b6a3ec40f1a34363d56abbfe7c52f57b9cd6233ee34b82345ccc07f

is that correct? adding both version and the sha256?

this is the docker image which I could not get to work - I just whitelisted:
actionhippie/calens@244f3e5,

@jesmrec jesmrec force-pushed the fix/changes_ci_security branch 2 times, most recently from 3b101e8 to e31275f Compare April 7, 2026 06:48
@DeepDiver1975
Copy link
Copy Markdown
Member

DeepDiver1975 commented Apr 7, 2026

  • dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 #v20

It fetchs the latest artifact generated by other workflow: used for update tests

Ref: https://github.com/dawidd6/action-download-artifact

can you look into the official action? https://github.com/marketplace/actions/download-a-build-artifact

Thank you

@DeepDiver1975
Copy link
Copy Markdown
Member

DeepDiver1975 commented Apr 7, 2026

  • reactivecircus/android-emulator-runner@4fe4b1ae376568ff65de774de6c0ca8070944022 #v2.37.0

It raises up an emulator: used for the instrumented tests, E2E tests and update tests

Ref: https://github.com/ReactiveCircus/android-emulator-runner

* `GuillaumeFalourd/git-commit-push@205c043bca2f932f7a48a28a8d619ba30eb84ba #v1.3`

It commits the generated content in the workflow: used for calens and SBOM

Ref: https://github.com/GuillaumeFalourd/git-commit-push

white listed

@jesmrec jesmrec force-pushed the fix/changes_ci_security branch 2 times, most recently from 83dbcb8 to b6213ce Compare April 7, 2026 08:13
@jesmrec
Copy link
Copy Markdown
Collaborator Author

jesmrec commented Apr 7, 2026

can you look into the official action? https://github.com/marketplace/actions/download-a-build-artifact

Such action only allows to download artifacts from jobs inside the same workflow execution. dawidd6/action-download-artifact allows to download artifacts from other workflows, that's the difference.

Anyway, this action is not a hard-requirement, dawidd6/action is just used in the update tests in order not to generate the same apk from latest in every night execution. We just generate it once per week and fetch in the daily executions. We could generate it in every execution and reduce the frequence from 5 times per week to 3 times per week (more than enough for our current run)

@jesmrec jesmrec force-pushed the fix/changes_ci_security branch 5 times, most recently from f523e79 to 537e037 Compare April 7, 2026 12:43
@jesmrec jesmrec force-pushed the fix/changes_ci_security branch from 544e7ee to f1eb3a7 Compare April 7, 2026 13:08
@jesmrec jesmrec requested review from DeepDiver1975 and joragua April 7, 2026 13:17
@jesmrec jesmrec marked this pull request as ready for review April 7, 2026 13:17
joragua
joragua approved these changes Apr 7, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@joragua joragua left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! 👍🏻

@jesmrec
Copy link
Copy Markdown
Collaborator Author

jesmrec commented Apr 7, 2026

Thanks all for your inputs!!

@jesmrec jesmrec merged commit a666d1e into master Apr 7, 2026
12 checks passed
@jesmrec jesmrec deleted the fix/changes_ci_security branch April 7, 2026 14:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@DeepDiver1975 DeepDiver1975 DeepDiver1975 approved these changes

@joragua joragua joragua approved these changes

Assignees

@jesmrec jesmrec

Labels

GitHub Actions

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@jesmrec @DeepDiver1975 @joragua @ownclouders