version 1.3

.github/dependabot.yml

@@ -0,0 +1,123 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns: ["*"]
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+
+  - package-ecosystem: gradle
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "org.bouncycastle:bcprov-jdk18on"
+        versions: [">= 1.85"]
+      - dependency-name: "org.bouncycastle:bcpkix-jdk18on"
+        versions: [">= 1.85"]
+      - dependency-name: "org.bouncycastle:bcutil-jdk18on"
+        versions: [">= 1.85"]
+      - dependency-name: "org.bitbucket.b_c:jose4j"
+        versions: [">= 0.9.7"]
+      - dependency-name: "org.jdom:jdom2"
+        versions: [">= 2.0.7"]
+      - dependency-name: "org.apache.commons:commons-lang3"
+        versions: [">= 3.19"]
+    groups:
+      kotlin:
+        patterns:
+          - "org.jetbrains.kotlin*"
+          - "org.jetbrains.kotlinx*"
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+      android-gradle-plugin:
+        patterns:
+          - "com.android*"
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+      compose:
+        patterns:
+          - "org.jetbrains.compose*"
+          - "androidx.compose*"
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+      androidx:
+        patterns:
+          - "androidx*"
+        exclude-patterns:
+          - "androidx.compose*"
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+      ktor:
+        patterns:
+          - "io.ktor*"
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+      koin:
+        patterns:
+          - "io.insert-koin*"
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+      sqldelight:
+        patterns:
+          - "app.cash.sqldelight*"
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+      okio-okhttp:
+        patterns:
+          - "com.squareup.okio*"
+          - "com.squareup.okhttp3*"
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+      gradle-wrapper:
+        patterns:
+          - "gradle-wrapper"
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+      play-publisher:
+        patterns:
+          - "com.github.triplet.play"
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+      other-gradle:
+        patterns: ["*"]
+        exclude-patterns:
+          - "org.jetbrains.kotlin*"
+          - "org.jetbrains.kotlinx*"
+          - "com.android*"
+          - "org.jetbrains.compose*"
+          - "androidx*"
+          - "io.ktor*"
+          - "io.insert-koin*"
+          - "app.cash.sqldelight*"
+          - "com.squareup.okio*"
+          - "com.squareup.okhttp3*"
+          - "gradle-wrapper"
+          - "com.github.triplet.play"
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+
+  - package-ecosystem: cargo
+    directory: /desktopApp
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      cargo-minor-patch:
+        patterns: ["*"]
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+      cargo-major:
+        patterns: ["*"]
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /infra/opensymbols-proxy
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      npm-minor-patch:
+        patterns: ["*"]
+        update-types: ["version-update:semver-patch", "version-update:semver-minor"]
+      npm-major:
+        patterns: ["*"]
+        update-types: ["version-update:semver-major"]

.github/workflows/dependency-submission.yml

@@ -0,0 +1,31 @@
+name: Gradle dependency submission
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  submit-gradle-dependencies:
+    name: Submit Gradle dependency graph
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        with:
+          distribution: temurin
+          java-version: 21
+      - name: Generate and submit the Gradle dependency graph
+        uses: gradle/actions/dependency-submission@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        with:
+          cache-provider: basic
+          dependency-graph: generate-and-submit
+          # AGP (lint, UTP emulator control) and Kotlin toolchain (swift-export) resolve
+          # build-time-only dependencies in detached configurations, which ignore
+          # resolutionStrategy forces. They never ship in any client artifact, so they are
+          # excluded from the submitted graph instead of being forced or dismissed.
+          dependency-graph-exclude-configurations: 'detachedConfiguration.*'

.github/workflows/deploy-play.yml

@@ -23,31 +23,50 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: 21
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        with:
+          cache-provider: basic
       - name: Compile, lint, and test Android
         run: bash ci_scripts/verify_android.sh
+      - name: Enable KVM for the Android emulator
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
+            | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+      - name: Run critical Android UI tests
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
+        with:
+          api-level: 35
+          arch: x86_64
+          profile: pixel_6
+          emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
+          disable-animations: true
+          script: ./gradlew :androidApp:connectedDebugAndroidTest --console=plain
 
   deploy:
     name: Deploy ${{ github.ref_name }}
     needs: verify
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: 21
 
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        with:
+          cache-provider: basic
 
       - name: Set Android version
         id: version
@@ -92,28 +111,24 @@ jobs:
       - name: Prepare tagged Play Store release notes
         run: bash ci_scripts/prepare_play_release_notes.sh "${{ steps.version.outputs.release_tag }}" beta
 
-      - name: Install Infisical CLI
-        run: |
-          set -o pipefail
-          curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | sudo -E bash
-          sudo apt-get update
-          sudo apt-get install -y infisical
-          infisical --version
+      - name: Fetch Infisical secrets
+        uses: Infisical/secrets-action@6cd3f7c0e4cc0d2395ee4ef414eb6eeb5d3e73db # v1.0.17
+        with:
+          method: universal
+          client-id: ${{ secrets.INFISICAL_CLIENT_ID }}
+          client-secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
+          project-slug: ${{ vars.INFISICAL_PROJECT_SLUG }}
+          env-slug: prod
+          domain: https://eu.infisical.com
 
       - name: Publish to Google Play open beta
         run: >-
-          infisical run --projectId="$INFISICAL_PROJECT_ID" --env=prod --
           ./gradlew :androidApp:publishReleaseBundle
           --track beta
           --release-name "Wingmate $WINGMATE_VERSION_NAME"
-        env:
-          INFISICAL_TOKEN: ${{ secrets.INFISICAL_TOKEN }}
-          INFISICAL_PROJECT_ID: ad96050f-9132-4f4e-ae16-e46e4c5734fc
-          INFISICAL_API_URL: https://eu.infisical.com
-          INFISICAL_SKIP: "1"
 
       - name: Upload AAB artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: android-${{ steps.version.outputs.release_tag }}