Update GitHub Actions versions and permissions #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test & Build Validation | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| branches: [ main, develop ] | |
| # Declare default permissions as read-only. | |
| permissions: read-all | |
| jobs: | |
| test_and_analyze: | |
| name: Test & Analyze | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| checks: write | |
| pull-requests: write | |
| security-events: write | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2 | |
| - name: Setup Java | |
| uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.4.0 | |
| with: | |
| distribution: 'zulu' | |
| java-version: '17' | |
| cache: 'gradle' | |
| - name: Setup Flutter | |
| uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.16.0 | |
| with: | |
| flutter-version: '3.41.9' | |
| channel: 'stable' | |
| cache: true | |
| - name: Get dependencies | |
| run: flutter pub get | |
| - name: Check formatting | |
| run: dart format --set-exit-if-changed . | |
| - name: Analyze code | |
| run: flutter analyze | |
| - name: Run unit tests | |
| run: flutter test --coverage | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| file: ./coverage/lcov.info | |
| fail_ci_if_error: false | |
| - name: Archive coverage reports | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.4.3 | |
| with: | |
| name: code-coverage | |
| path: coverage/ | |
| build_android: | |
| name: Build Android APK | |
| needs: test_and_analyze | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop') | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2 | |
| - name: Setup Java | |
| uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.4.0 | |
| with: | |
| distribution: 'zulu' | |
| java-version: '17' | |
| cache: 'gradle' | |
| - name: Setup Flutter | |
| uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.16.0 | |
| with: | |
| flutter-version: '3.41.9' | |
| channel: 'stable' | |
| cache: true | |
| - name: Get dependencies | |
| run: flutter pub get | |
| - name: Build APK | |
| run: flutter build apk --debug --dart-define=SUPABASE_URL=${{ secrets.SUPABASE_URL }} --dart-define=SUPABASE_ANON_KEY=${{ secrets.SUPABASE_ANON_KEY }} | |
| - name: Upload APK | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.4.3 | |
| with: | |
| name: release-apk | |
| path: build/app/outputs/flutter-apk/app-debug.apk | |
| build_ios: | |
| name: Build iOS App | |
| needs: test_and_analyze | |
| runs-on: macos-latest | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2 | |
| - name: Setup Flutter | |
| uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.16.0 | |
| with: | |
| flutter-version: '3.41.9' | |
| channel: 'stable' | |
| cache: true | |
| - name: Get dependencies | |
| run: flutter pub get | |
| - name: Build iOS | |
| run: flutter build ios --no-codesign --debug --dart-define=SUPABASE_URL=${{ secrets.SUPABASE_URL }} --dart-define=SUPABASE_ANON_KEY=${{ secrets.SUPABASE_ANON_KEY }} | |
| - name: Upload Runner | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.4.3 | |
| with: | |
| name: ios-build | |
| path: build/ios/iphoneos/Runner.app | |
| security_scan: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3.27.6 | |
| with: | |
| languages: javascript, python | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3.27.6 |