Merge branch 'main' into rz/fix/gesture-lifecycle

Author: romtsn

.claude/skills/btrace-perfetto/SKILL.md

@@ -22,7 +22,26 @@ Before starting, verify:
    ```
 3. **Perfetto trace_processor**: Check if `/tmp/trace_processor` exists. If not, download it:
    ```bash
-   curl -sL "https://get.perfetto.dev/trace_processor" -o /tmp/trace_processor && chmod +x /tmp/trace_processor
+   # Download trace_processor (--fail ensures HTTP errors don't leave a file behind)
+   curl -sSL --fail "https://get.perfetto.dev/trace_processor" -o /tmp/trace_processor
+
+   # Verify magic bytes directly — file(1) output is too inconsistent across
+   # versions/platforms to rely on for scripts or PIE binaries.
+   magic=$(head -c 4 /tmp/trace_processor 2>/dev/null | od -An -vtx1 -N4 | tr -d ' \n')
+   case "$magic" in
+     2321*)                               ;; # #! shebang (script)
+     7f454c46)                            ;; # ELF (Linux)
+     cffaedfe|cefaedfe|feedfacf|feedface) ;; # Mach-O (macOS)
+     cafebabe)                            ;; # Mach-O universal
+     *)
+       echo "Error: Downloaded file is not a valid script or executable (magic: ${magic:-empty})"
+       rm -f /tmp/trace_processor
+       exit 1
+       ;;
+   esac
+
+   # Make executable only after verification
+   chmod +x /tmp/trace_processor
    ```
 4. **Device ABI**: Run `adb shell getprop ro.product.cpu.abi` — btrace only supports arm64-v8a and armeabi-v7a (no x86/x86_64)
 

.github/workflows/agp-matrix.yml

@@ -50,7 +50,7 @@ jobs:
           sudo udevadm trigger --name-match=kvm
 
       - name: AVD cache
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         id: avd-cache
         with:
           path: |

.github/workflows/build.yml

@@ -31,7 +31,7 @@ jobs:
 
       # Workaround for https://github.com/gradle/actions/issues/21 to use config cache
       - name: Cache buildSrc
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: buildSrc/build
           key: build-logic-${{ hashFiles('buildSrc/src/**', 'buildSrc/build.gradle.kts','buildSrc/settings.gradle.kts') }}

.github/workflows/changelog-preview.yml

@@ -15,5 +15,5 @@ permissions:
 
 jobs:
   changelog-preview:
-    uses: getsentry/craft/.github/workflows/changelog-preview.yml@ba01e596c4a4c07692f0de10b0d4fe05f3dd0292 # v2
+    uses: getsentry/craft/.github/workflows/changelog-preview.yml@97d0c4286f32a80d09c8b89366d762fecc3e27b6 # v2
     secrets: inherit

.github/workflows/codeql-analysis.yml

@@ -36,7 +36,7 @@ jobs:
           cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # pin@v2
+        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # pin@v2
         with:
           languages: 'java'
 
@@ -45,4 +45,4 @@ jobs:
           ./gradlew buildForCodeQL --no-build-cache
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # pin@v2
+        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # pin@v2

.github/workflows/integration-tests-benchmarks.yml

@@ -92,7 +92,7 @@ jobs:
         with:
           cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
 
-      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         id: app-plain-cache
         with:
           path: sentry-android-integration-tests/test-app-plain/build/outputs/apk/release/test-app-plain-release.apk

.github/workflows/integration-tests-size.yml

@@ -30,7 +30,7 @@ jobs:
 
       # Workaround for https://github.com/gradle/actions/issues/21 to use config cache
       - name: Cache buildSrc
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: buildSrc/build
           key: build-logic-${{ hashFiles('buildSrc/src/**', 'buildSrc/build.gradle.kts','buildSrc/settings.gradle.kts') }}

.github/workflows/integration-tests-ui-critical.yml

@@ -67,10 +67,6 @@ jobs:
             target: google_apis
             channel: canary # Necessary for ATDs
             arch: x86_64
-          - api-level: 34 # Android 14
-            target: google_apis
-            channel: canary # Necessary for ATDs
-            arch: x86_64
           - api-level: 35 # Android 15
             target: google_apis
             channel: canary # Necessary for ATDs
@@ -90,7 +86,7 @@ jobs:
           sudo udevadm trigger --name-match=kvm
 
       - name: AVD cache
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         id: avd-cache
         with:
           path: |

.github/workflows/release.yml

@@ -34,7 +34,7 @@ jobs:
           fetch-depth: 0
           submodules: 'recursive'
       - name: Prepare release
-        uses: getsentry/craft@ba01e596c4a4c07692f0de10b0d4fe05f3dd0292 # v2
+        uses: getsentry/craft@97d0c4286f32a80d09c8b89366d762fecc3e27b6 # v2
         env:
           GITHUB_TOKEN: ${{ steps.token.outputs.token }}
         with:

.github/workflows/spring-boot-2-matrix.yml

@@ -50,7 +50,7 @@ jobs:
 
       # Workaround for https://github.com/gradle/actions/issues/21 to use config cache
       - name: Cache buildSrc
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: buildSrc/build
           key: build-logic-${{ hashFiles('buildSrc/src/**', 'buildSrc/build.gradle.kts','buildSrc/settings.gradle.kts') }}