Release v1.8.177 — SHA-pin every third-party Action + osv-scanner binary

SysAdminDoc · SysAdminDoc · commit 1e1c6944c446 · 2026-05-25T21:08:13.000-04:00
Supply-chain hardening. 7 of 8 workflows previously used floating major-tag pins (actions/checkout@v4, gradle/actions/setup-gradle@v4, reactivecircus/android-emulator-runner@v2, google/osv-scanner-action@v2.0.2, etc). A compromise of any action's repository would re-point those tags at malicious code, executed by the next CI run. release.yml additionally curl-downloaded the osv-scanner v2.0.2 binary without SHA-256 verification — a CDN-level swap would run unverified code on the runner. Changes: SHA-pinned 9 distinct action@tag references across all 8 workflows. SHAs resolved via `gh api repos/<owner>/<repo>/git/refs/tags/<tag>` against the live GitHub API on the run date; annotated tags dereferenced one level. actions/checkout@v4 -> @34e114876b0b... actions/setup-java@v4 -> @c1e323688fd8... actions/upload-artifact@v4 -> @ea165f8d65b6... actions/dependency-review-action@v4 -> @4901385134134... gradle/actions/wrapper-validation@v4 -> @48b5f213c810... gradle/actions/setup-gradle@v4 -> @48b5f213c810... lukka/get-cmake@v4.0.2 -> @ea004816823209... google/osv-scanner-action@v2.0.2 -> @e69cc6c86b31... reactivecircus/android-emulator-runner@v2 -> @e89f39f1abbb... SHA-256-pinned the osv-scanner v2.0.2 binary in release.yml. New OSV_BINARY_SHA256 env carries 3abcfd7126c453a00421487e721b296e0cb68085bd431d6cef60872774170fc8; the step runs sha256sum against the downloaded binary and refuses to execute on mismatch with a clear ::error:: message. A future v2.x.y bump requires re-recording the digest alongside the URL bump. Closes RESEARCH_FEATURE_PLAN.md F19 + F20. Verification: - grep -rn "uses: [a-zA-Z0-9_/.-]\+@v" .github/workflows/ -> no matches - bash scripts/check-fastlane-metadata.sh -> OK (versionCode 1977) - bash scripts/check-repo-hygiene.sh -> OK - osv-scanner SHA-256 confirmed off-runner via curl + sha256sum - Gradle gates deferred to maintainer host per CLAUDE.md
diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
@@ -38,11 +38,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
 
-      - uses: gradle/actions/wrapper-validation@v4
+      - uses: gradle/actions/wrapper-validation@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
 
       - name: Check root crash/replay logs
         run: bash scripts/check-no-root-crash-logs.sh
@@ -60,16 +60,16 @@ jobs:
         run: bash scripts/check-fastlane-metadata.sh
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: 17
           distribution: temurin
 
       - name: Set up CMake and Ninja
-        uses: lukka/get-cmake@v4.0.2
+        uses: lukka/get-cmake@ea004816823209b8d1211e47b216185caee12cc5 # v4.0.2
 
       - name: Cache Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
 
       - name: Verify no-network contract (N7.1)
         run: ./gradlew :app:verifyNoInternetPermission
@@ -123,14 +123,14 @@ jobs:
           echo "All shipped native libraries (if any) are 16 KB aligned."
 
       - name: Upload debug APK
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: app-debug.apk
           path: app/build/outputs/apk/debug/app-debug.apk
 
       - name: Upload lint report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: lint-debug-report
           path: |
@@ -140,7 +140,7 @@ jobs:
 
       - name: Upload unit-test report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: unit-test-report
           path: app/build/reports/tests/testDebugUnitTest/
diff --git a/.github/workflows/crowdin-upload.yml b/.github/workflows/crowdin-upload.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Upload
         # SHA pin: crowdin/github-action@v2 = 8868a33591d21088edfc398968173a3b98d51706
         # Verified 2026-05-17 via `GET /repos/crowdin/github-action/git/refs/tags/v2`.
diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml
@@ -40,36 +40,36 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
       - name: Run dependency-review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@4901385134134e04cec5fbe5ddfe3b2c5bd5d976 # v4
         with:
           fail-on-severity: high
           comment-summary-in-pr: on-failure
 
   osv-scanner:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: 17
           distribution: temurin
 
       - name: Cache Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
 
       - name: Generate Gradle dependency tree
         run: ./gradlew :app:dependencies --configuration releaseRuntimeClasspath > gradle-deps.txt
 
       - name: Run OSV-Scanner against the lockfiles + dep tree
-        uses: google/osv-scanner-action/osv-scanner-action@v2.0.2
+        uses: google/osv-scanner-action/osv-scanner-action@e69cc6c86b31f1e7e23935bbe7031b50e51082de # v2.0.2
         with:
           scan-args: |-
             --recursive
@@ -79,7 +79,7 @@ jobs:
 
       - name: Upload dep tree artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: gradle-dep-tree
           path: gradle-deps.txt
diff --git a/.github/workflows/emulator-smoke.yml b/.github/workflows/emulator-smoke.yml
@@ -28,23 +28,23 @@ jobs:
     timeout-minutes: 35
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
 
-      - uses: gradle/actions/wrapper-validation@v4
+      - uses: gradle/actions/wrapper-validation@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: 17
           distribution: temurin
 
       - name: Set up CMake and Ninja
-        uses: lukka/get-cmake@v4.0.2
+        uses: lukka/get-cmake@ea004816823209b8d1211e47b216185caee12cc5 # v4.0.2
 
       - name: Cache Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
 
       - name: Build debug APK
         run: ./gradlew :app:assembleDebug
@@ -56,7 +56,7 @@ jobs:
           sudo udevadm trigger --name-match=kvm
 
       - name: Launch settings on emulator
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@e89f39f1abbbd05b1113a29cf4db69e7540cae5a # v2
         with:
           api-level: 35
           arch: x86_64
@@ -77,7 +77,7 @@ jobs:
 
       - name: Upload emulator smoke logcat
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: emulator-smoke-logcat
           path: emulator-smoke-logcat.txt
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -38,21 +38,21 @@ jobs:
     env:
       SIGNING_KEYSTORE_BASE64: ${{ secrets.SIGNING_KEYSTORE_BASE64 }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
           fetch-depth: 0
 
-      - uses: gradle/actions/wrapper-validation@v4
+      - uses: gradle/actions/wrapper-validation@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: 17
           distribution: temurin
 
       - name: Cache Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
 
       - name: Make gradlew executable
         run: chmod +x ./gradlew
@@ -90,9 +90,23 @@ jobs:
       - name: Run OSV-Scanner against the release tree
         id: osv-scan
         continue-on-error: true
+        env:
+          # SHA-256 of google/osv-scanner v2.0.2 linux_amd64. Pin the binary
+          # by content hash so a compromised GitHub Releases CDN cannot swap a
+          # malicious build under the same version tag. Refresh this value
+          # alongside any v2.0.2 -> v2.x.y bump and re-record the digest.
+          OSV_BINARY_SHA256: "3abcfd7126c453a00421487e721b296e0cb68085bd431d6cef60872774170fc8"
         run: |
           set +e
           curl -sSL -o osv-scanner "https://github.com/google/osv-scanner/releases/download/v2.0.2/osv-scanner_linux_amd64"
+          actual_sha="$(sha256sum osv-scanner | awk '{print $1}')"
+          if [ "$actual_sha" != "$OSV_BINARY_SHA256" ]; then
+            echo "::error::osv-scanner SHA-256 mismatch."
+            echo "  expected: $OSV_BINARY_SHA256"
+            echo "  actual:   $actual_sha"
+            echo "  Refusing to execute an unverified binary."
+            exit 1
+          fi
           chmod +x osv-scanner
           ./osv-scanner --recursive --skip-git --format=json ./ > osv-result.json
           osv_exit=$?
@@ -127,7 +141,7 @@ jobs:
 
       - name: Upload OSV scan artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: swiftfloris-v${{ inputs.version }}-osv
           path: |
@@ -208,7 +222,7 @@ jobs:
           echo '```' >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: swiftfloris-v${{ inputs.version }}
           path: |
diff --git a/.github/workflows/reproducible-build.yml b/.github/workflows/reproducible-build.yml
@@ -48,31 +48,31 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
           fetch-depth: 0
 
-      - uses: gradle/actions/wrapper-validation@v4
+      - uses: gradle/actions/wrapper-validation@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: 17
           distribution: temurin
 
       - name: Set up CMake and Ninja
-        uses: lukka/get-cmake@v4.0.2
+        uses: lukka/get-cmake@ea004816823209b8d1211e47b216185caee12cc5 # v4.0.2
 
       - name: Cache Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
 
       - name: Verify release APK reproducibility
         run: bash scripts/verify-reproducible-apk.sh "$RUNNER_TEMP/reproducible-apk"
 
       - name: Upload reproducibility artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: reproducible-apk-${{ github.sha }}
           path: ${{ runner.temp }}/reproducible-apk/
diff --git a/.github/workflows/roborazzi-baseline.yml b/.github/workflows/roborazzi-baseline.yml
@@ -36,20 +36,20 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
 
-      - uses: gradle/actions/wrapper-validation@v4
+      - uses: gradle/actions/wrapper-validation@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: 17
           distribution: temurin
 
       - name: Cache Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
 
       - name: Make gradlew executable
         run: chmod +x ./gradlew
@@ -81,7 +81,7 @@ jobs:
 
       - name: Upload baseline artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: roborazzi-baselines-${{ github.run_id }}${{ inputs.message && format('-{0}', inputs.message) || '' }}
           path: app/src/test/snapshots/images/
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,62 @@
 
 All SwiftFloris release history is consolidated here. This replaces the former root-level `RELEASE_NOTES_v*.md` file-per-release pattern.
 
+<a id="v1.8.177"></a>
+## v1.8.177
+
+Released: 2026-05-25
+
+### Supply-chain hardening (RESEARCH_FEATURE_PLAN.md F19 + F20)
+
+The 2026-05-25 build/CI reconnaissance pass found that 7 of 8 GitHub Actions workflows used floating major-tag pins (e.g. `actions/checkout@v4`, `gradle/actions/setup-gradle@v4`, `reactivecircus/android-emulator-runner@v2`, `google/osv-scanner-action@v2.0.2`). A floating tag's underlying commit can be re-pointed by the action's owner after the fact; a compromise of any action's repo would re-point the tag at malicious code, and the next CI run on SwiftFloris would execute it. Only `crowdin-upload.yml` and `validate-strings-no-translations.yml` already SHA-pinned. Additionally, `release.yml`'s OSV-Scanner step downloaded the v2.0.2 binary via curl without SHA-256 verification — a CDN-level swap would similarly run unverified code on the runner.
+
+### Changes
+
+- **SHA-pinned every third-party action across all 8 workflows.** The mapping (each replacement is exact `action@tag` → `action@<sha> # tag`):
+  - `actions/checkout@v4` → `@34e114876b0b11c390a56381ad16ebd13914f8d5`
+  - `actions/setup-java@v4` → `@c1e323688fd81a25caa38c78aa6df2d33d3e20d9`
+  - `actions/upload-artifact@v4` → `@ea165f8d65b6e75b540449e92b4886f43607fa02`
+  - `actions/dependency-review-action@v4` → `@4901385134134e04cec5fbe5ddfe3b2c5bd5d976`
+  - `gradle/actions/wrapper-validation@v4` → `@48b5f213c81028ace310571dc5ec0fbbca0b2947`
+  - `gradle/actions/setup-gradle@v4` → `@48b5f213c81028ace310571dc5ec0fbbca0b2947`
+  - `lukka/get-cmake@v4.0.2` → `@ea004816823209b8d1211e47b216185caee12cc5`
+  - `google/osv-scanner-action/osv-scanner-action@v2.0.2` → `@e69cc6c86b31f1e7e23935bbe7031b50e51082de`
+  - `reactivecircus/android-emulator-runner@v2` → `@e89f39f1abbbd05b1113a29cf4db69e7540cae5a`
+  SHAs were resolved via `gh api repos/<owner>/<repo>/git/refs/tags/<tag>` against the live GitHub API on the run date; annotated tags were dereferenced one level to the underlying commit object.
+- **SHA-256-pinned the `osv-scanner` v2.0.2 binary in `.github/workflows/release.yml`.** Added an `OSV_BINARY_SHA256` env on the OSV scan step (value `3abcfd7126c453a00421487e721b296e0cb68085bd431d6cef60872774170fc8`); the step now runs `sha256sum` against the downloaded binary and refuses to execute on mismatch with a clear `::error::` message. A future bump to `v2.x.y` requires re-recording the digest alongside the URL bump.
+
+### Verification
+
+- `grep -rn "uses: [a-zA-Z0-9_/.-]\+@v" .github/workflows/` returns no matches (no unpinned actions remain at HEAD).
+- `grep -rn "uses: " .github/workflows/` returns 41 references, all carrying `@<sha> # <tag>` form.
+- `curl -sSL .../osv-scanner_linux_amd64 | sha256sum` was computed off-runner to confirm the env value: `3abcfd7126c453a00421487e721b296e0cb68085bd431d6cef60872774170fc8`.
+- `bash scripts/check-repo-hygiene.sh` → OK.
+- `bash scripts/check-fastlane-metadata.sh` → OK (versionCode 1977).
+
+### Bump guidance
+
+To bump an action across the project:
+1. Pick the new version tag.
+2. Resolve the commit SHA via `gh api repos/<owner>/<repo>/git/refs/tags/<tag>` (dereference annotated tags).
+3. Replace every occurrence of the old SHA with the new SHA; update the trailing `# vN.Y` comment to match.
+4. If the new tag changes major version, treat as a breaking change and run the workflow on a draft branch first.
+
+### Files Touched
+
+- `.github/workflows/android.yml`
+- `.github/workflows/dependency-scan.yml`
+- `.github/workflows/emulator-smoke.yml`
+- `.github/workflows/reproducible-build.yml`
+- `.github/workflows/release.yml` (SHA-pins + OSV binary verification)
+- `.github/workflows/roborazzi-baseline.yml`
+- `.github/workflows/crowdin-upload.yml`
+- `.github/workflows/validate-strings-no-translations.yml`
+- `fastlane/metadata/android/en-US/changelogs/1977.txt` (new)
+- `gradle.properties` (versionCode 1976→1977, versionName 1.8.176→1.8.177)
+- `README.md` (version badge)
+- `CHANGELOG.md` (this section)
+- `RESEARCH_FEATURE_PLAN.md` (tick F19 + F20)
+
 <a id="v1.8.176"></a>
 ## v1.8.176
 
diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 # SwiftFloris
 
-![Version](https://img.shields.io/badge/version-v1.8.176-blue) ![License](https://img.shields.io/badge/license-Apache%202.0-green) ![Platform](https://img.shields.io/badge/platform-Android%208.0+-orange) ![Network](https://img.shields.io/badge/network-none-lightgrey) ![SwiftKey migration](https://img.shields.io/badge/SwiftKey%20migration-window%20closes%202026--05--31-red)
+![Version](https://img.shields.io/badge/version-v1.8.177-blue) ![License](https://img.shields.io/badge/license-Apache%202.0-green) ![Platform](https://img.shields.io/badge/platform-Android%208.0+-orange) ![Network](https://img.shields.io/badge/network-none-lightgrey) ![SwiftKey migration](https://img.shields.io/badge/SwiftKey%20migration-window%20closes%202026--05--31-red)
 
 **SwiftFloris** is a privacy-first Android keyboard, forked from FlorisBoard and pushed toward SwiftKey-class multilingual typing without the cloud. It ships under Apache-2.0, holds no `INTERNET` permission, and binds zero accounts.
 
diff --git a/RESEARCH_FEATURE_PLAN.md b/RESEARCH_FEATURE_PLAN.md
@@ -993,9 +993,9 @@ The items above promote to:
 
 - [ ] **P1** — F18 — **F5 refactor**: ship a `Default SmartComposeProvider` that consumes the existing `PersonalTrigramStore` + `PersonalBigramStore` + `ColdStartNextWordPriors` chain (instead of returning `NoSuggestion`). The wire-up at `NlpManager.kt:290` already exists. This makes ghost-text work without an addon. Touches: new `ime/smartcompose/HeuristicSmartComposeProvider.kt`, `SmartComposeProviderRegistry`, `app/AppPrefs.kt` (gate), `app/settings/typing/`. Acceptance: with the new toggle on and confidence-gated, ghost text renders inline from the existing trigram chain. Replaces / refines F5. Complexity: S-M.
 
-- [ ] **P1** — F19 — **SHA-pin every third-party action**. Touches: `android.yml`, `release.yml`, `dependency-scan.yml`, `emulator-smoke.yml`, `reproducible-build.yml`, `roborazzi-baseline.yml`. Acceptance: every `uses: foo/bar@vN` becomes `uses: foo/bar@<sha>` with a comment recording the version. Complexity: S.
+- [x] **P1** — F19 — **SHA-pin every third-party action**. Touches: every workflow under `.github/workflows/`. Acceptance: every `uses: foo/bar@vN` becomes `uses: foo/bar@<sha>` with a comment recording the version. Complexity: S. **Shipped v1.8.177 (2026-05-25)** — 9 distinct action references SHA-pinned across all 8 workflows; SHAs resolved via `gh api`; full mapping in `CHANGELOG.md#v1.8.177`.
 
-- [ ] **P1** — F20 — **SHA-256-pin the `osv-scanner v2.0.2` curl download** in `release.yml:95` (or migrate to the SHA-pinned `google/osv-scanner-action`). Acceptance: planted swap of the URL fails CI. Complexity: S.
+- [x] **P1** — F20 — **SHA-256-pin the `osv-scanner v2.0.2` curl download** in `release.yml:95`. Acceptance: planted swap of the URL fails CI. Complexity: S. **Shipped v1.8.177 (2026-05-25)** — `OSV_BINARY_SHA256` env carries `3abcfd7126c453a00421487e721b296e0cb68085bd431d6cef60872774170fc8`; binary refuses to execute on mismatch.
 
 - [ ] **P1** — F21 — **Train an Apache-2.0 glide model from the MIT-licensed FUTO swipe dataset**. The 1.04M-row dataset at `huggingface.co/datasets/futo-org/swipe.futo.org` is MIT. Training is off-device; model ships in `addons/swipe-model-swiftfloris/` or inside the existing `swiftfloris-statistical` engine as a quantized weights file. Acceptance: N1.4 replay benchmark shows accuracy improvement vs `StatisticalGlideTypingClassifier`. Complexity: XL (out-of-tree training + integration). Priority gated on someone with ML infra; can promote into ROADMAP §6 N1.1 alternative.
 
diff --git a/fastlane/metadata/android/en-US/changelogs/1977.txt b/fastlane/metadata/android/en-US/changelogs/1977.txt
@@ -0,0 +1,5 @@
+v1.8.177 — supply-chain: SHA-pin every third-party GitHub Action + osv-scanner binary.
+
+Replaced floating tag references (@v4, @v2, @v2.0.2, @v4.0.2) with full commit-SHA pins for actions/checkout, actions/setup-java, actions/upload-artifact, actions/dependency-review-action, gradle/actions/{wrapper-validation,setup-gradle}, lukka/get-cmake, google/osv-scanner-action, and reactivecircus/android-emulator-runner. Pinned osv-scanner v2.0.2 binary by SHA-256.
+
+No user-facing behaviour changes.
diff --git a/gradle.properties b/gradle.properties
