MOBILE-121: bump GitHub action versions

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 1
+    groups:
+      github-actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: "deps"
+      include: "scope"

.github/workflows/manual-prepare_release_branch.yml

@@ -15,14 +15,18 @@ on:
         required: true
         default: 'master'
 
+permissions:
+  contents: read
+
 jobs:
   validate-input:
     name: Validate versions format
     runs-on: ubuntu-latest
     steps:
       - name: Check release_version
+        env:
+          V: ${{ github.event.inputs.release_version }}
         run: |
-          V=${{ github.event.inputs.release_version }}
           echo "Input release_version=$V"
           if ! [[ "$V" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-rc)?$ ]]; then
             echo "❌ release_version must be X.Y.Z or X.Y.Z-rc"
@@ -34,19 +38,21 @@ jobs:
     runs-on: ubuntu-latest
     needs: validate-input
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with: { fetch-depth: 0 }
       - name: Check source branch
+        env:
+          SRC: ${{ github.event.inputs.source_branch }}
         run: |
-          SRC=${{ github.event.inputs.source_branch }}
-          if ! git ls-remote --heads origin "$SRC" | grep -q "$SRC"; then
+          if [ -z "$(git ls-remote --heads origin "refs/heads/$SRC")" ]; then
             echo "❌ source_branch '$SRC' does not exist on origin"
             exit 1
           fi
       - name: Check target branch
+        env:
+          DST: ${{ github.event.inputs.target_branch }}
         run: |
-          DST=${{ github.event.inputs.target_branch }}
-          if ! git ls-remote --heads origin "$DST" | grep -q "$DST"; then
+          if [ -z "$(git ls-remote --heads origin "refs/heads/$DST")" ]; then
             echo "❌ target_branch '$DST' does not exist on origin"
             exit 1
           fi
@@ -55,10 +61,12 @@ jobs:
     name: Create release branch & bump versions
     runs-on: ubuntu-latest
     needs: validate-branches
+    permissions:
+      contents: write
     outputs:
       release_branch: ${{ steps.bump.outputs.release_branch }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.inputs.source_branch }}
           fetch-depth: 0
@@ -70,10 +78,11 @@ jobs:
 
       - id: bump
         name: Create branch & apply bumps
+        env:
+          VERSION: ${{ github.event.inputs.release_version }}
+          SRC: ${{ github.event.inputs.source_branch }}
         run: |
           set -euo pipefail
-          VERSION="${{ github.event.inputs.release_version }}"
-          SRC="${{ github.event.inputs.source_branch }}"
           REL="release/$VERSION"
           echo "→ Branching from $SRC into $REL"
           git checkout -b "$REL"
@@ -88,7 +97,7 @@ jobs:
           # 2) CHANGELOG.md: insert Unreleased section at top
           ##############################################################################
           echo "→ Inserting Unreleased section into CHANGELOG.md"
-  
+
           awk -v ver="$VERSION" '
             /^# Changelog/ {
               print
@@ -108,10 +117,12 @@ jobs:
           # 3) Final commit
           ##############################################################################
           git commit -m "Bump mindbox expo plugin versions: $VERSION"
-          echo "release_branch=$REL" >> $GITHUB_OUTPUT
+          echo "release_branch=$REL" >> "$GITHUB_OUTPUT"
 
       - name: Push release branch
-        run: git push --set-upstream origin ${{ steps.bump.outputs.release_branch }}
+        env:
+          REL: ${{ steps.bump.outputs.release_branch }}
+        run: git push --set-upstream origin "$REL"
 
   create_pull_request:
     name: Create Pull Request
@@ -124,15 +135,16 @@ jobs:
           SRC: ${{ needs.bump_and_branch.outputs.release_branch }}
           DST: ${{ github.event.inputs.target_branch }}
           REPO: ${{ github.repository }}
+          VERSION: ${{ github.event.inputs.release_version }}
         run: |
           BODY=$(
-            printf 'Automated PR: merge `%s` into `%s`\n\n**Versions:**\n- Mindbox Expo Plugin: `%s`\n' \
-              "$SRC" "$DST" "${{ github.event.inputs.release_version }}"
+            printf 'Automated PR: merge %s into %s\n\nVersions:\n- Mindbox Expo Plugin: %s\n' \
+              "$SRC" "$DST" "$VERSION"
           )
 
           gh pr create \
             --repo "$REPO" \
             --base "$DST" \
             --head "$SRC" \
-            --title "Release ${{ github.event.inputs.release_version }}" \
+            --title "Release $VERSION" \
             --body "$BODY"

.github/workflows/pr-description-validate.yml

@@ -6,17 +6,22 @@ on:
   issue_comment:
     types: [ created ]
 
+permissions:
+  contents: read
+
 jobs:
   check-description:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     if: ${{ github.event_name == 'pull_request' || github.event.issue.pull_request }}
     steps:
     - name: Check out the repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
     - name: Check PR description
       id: validate_description_step
-      uses: actions/github-script@v7
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         script: |
@@ -28,15 +33,15 @@ jobs:
             core.setOutput('pr_description_check_passed', 'true');
           }
     - name: Find Comment
-      uses: peter-evans/find-comment@v3
+      uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
       id: fc
       with:
         issue-number: ${{ github.event.pull_request.number }}
         comment-author: 'github-actions[bot]'
 
     - name: Update comment with validation failed statement
       if: ${{ steps.validate_description_step.outputs.pr_description_check_passed == 'false' }}
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
       with:
         issue-number: ${{ github.event.pull_request.number }}
         comment-id: ${{ steps.fc.outputs.comment-id }}

.github/workflows/publish-common-trigger.yml

@@ -8,29 +8,42 @@ on:
     - 'master'
     - 'support/*'
 
+permissions:
+  contents: read
+
 jobs:
   check-branch-for-manual:
     if: github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
     - name: Check if branch matches pattern
+      env:
+        REF_NAME: ${{ github.ref_name }}
       run: |
-        if ! echo "${{ github.ref_name }}" | grep -q "release/.*-rc"; then
+        if ! echo "$REF_NAME" | grep -q "release/.*-rc"; then
           echo "Branch name must match pattern 'release/*-rc'"
           exit 1
         fi
 
   publish-manual:
     if: github.event_name == 'workflow_dispatch'
     needs: check-branch-for-manual
+    permissions:
+      contents: write
+      id-token: write
     uses: ./.github/workflows/publish-reusable.yml
     with:
       branch: ${{ github.ref_name }}
-    secrets: inherit
+    secrets:
+      PAT_FOR_TRIGGERING_BRANCH_PROTECTION: ${{ secrets.PAT_FOR_TRIGGERING_BRANCH_PROTECTION }}
 
   publish-from-pr:
     if: github.event_name == 'pull_request' && github.event.pull_request.merged == true
+    permissions:
+      contents: write
+      id-token: write
     uses: ./.github/workflows/publish-reusable.yml
     with:
       branch: ${{ github.base_ref }}
-    secrets: inherit
+    secrets:
+      PAT_FOR_TRIGGERING_BRANCH_PROTECTION: ${{ secrets.PAT_FOR_TRIGGERING_BRANCH_PROTECTION }}

.github/workflows/publish-reusable.yml

@@ -6,10 +6,12 @@ on:
       branch:
         required: true
         type: string
+    secrets:
+      PAT_FOR_TRIGGERING_BRANCH_PROTECTION:
+        required: true
 
 permissions:
-  id-token: write
-  contents: write
+  contents: read
 
 jobs:
   checkingVersion:
@@ -20,62 +22,68 @@ jobs:
       newVersion: ${{ fromJson(steps.package.outputs.content)['target-version'] }}
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         ref: ${{ inputs.branch }}
     - name: Read package.json
       id: package
-      uses: juliangruber/read-file-action@v1
+      uses: juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18 # v1.1.8
       with:
         path: ./package.json
     - name: Version check
       if: ${{ fromJson(steps.package.outputs.content).version == fromJson(steps.package.outputs.content).target-version }}
-      uses: actions/github-script@v6
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
-          core.setFailed('Packet version and target version are equivalent!')
+          core.setFailed('Package version and target version are equivalent!')
 
   releasing:
     name: Releasing
     needs: [ checkingVersion ]
     if: needs.checkingVersion.outputs.isRunable == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         ref: ${{ inputs.branch }}
     - name: Setup node JS
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: 'lts/*'
         registry-url: https://registry.npmjs.org
     - name: Setup GIT
       run: |
-        git config user.email '$GITHUB_ACTOR@users.noreply.github.com'
-        git config user.name '$GITHUB_ACTOR'
+        git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+        git config user.name "$GITHUB_ACTOR"
     - name: Setup local environment
       run: yarn
     - name: Determine Pre-Release Status
       id: prerelease_check
+      env:
+        NEW_VERSION: ${{ needs.checkingVersion.outputs.newVersion }}
       run: |
-        VERSION=${{ needs.checkingVersion.outputs.newVersion }}
-        if [[ "$VERSION" == *"rc"* ]]; then
-          echo "::set-output name=is_prerelease::true"
+        if [[ "$NEW_VERSION" == *"rc"* ]]; then
+          echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
         else
-          echo "::set-output name=is_prerelease::false"
+          echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
         fi
     - name: Release
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        NEW_VERSION: ${{ needs.checkingVersion.outputs.newVersion }}
+        IS_PRERELEASE: ${{ steps.prerelease_check.outputs.is_prerelease }}
       run: |
         npm install -g npm@latest
         yarn install
         yarn build
-        if [ ${{ steps.prerelease_check.outputs.is_prerelease }} == "true" ]; then
-          yarn release ${{ needs.checkingVersion.outputs.newVersion }} --pre-release --no-plugins.@release-it/keep-a-changelog.strictLatest --ci
+        if [ "$IS_PRERELEASE" == "true" ]; then
+          yarn release "$NEW_VERSION" --pre-release --no-plugins.@release-it/keep-a-changelog.strictLatest --ci
         else
-          yarn release ${{ needs.checkingVersion.outputs.newVersion }} --no-plugins.@release-it/keep-a-changelog.strictLatest --ci
+          yarn release "$NEW_VERSION" --no-plugins.@release-it/keep-a-changelog.strictLatest --ci
         fi
 
   merge:
@@ -88,12 +96,12 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.PAT_FOR_TRIGGERING_BRANCH_PROTECTION }}
     steps:
     - name: Checkout develop branch
-      uses: actions/checkout@v4
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         ref: develop
     - name: Create Pull Request
       run: gh pr create --base develop --head master --title "Merge 'master' into 'develop' after release" --body "Automated Pull Request to merge 'master' into 'develop' after release"
     - name: Merge Pull Request
       run: |
         pr_number=$(gh pr list --base develop --head master --json number --jq '.[0].number')
-        gh pr merge $pr_number --merge --auto
+        gh pr merge "$pr_number" --merge --auto

.github/workflows/release-version-check.yml

@@ -7,44 +7,49 @@ on:
     - master
     - develop
 
+permissions:
+  contents: read
+
 jobs:
   check-rc-pattern:
     runs-on: ubuntu-latest
     if: startsWith(github.head_ref, 'release')
     steps:
     - name: Check RC pattern
+      env:
+        HEAD_REF: ${{ github.head_ref }}
       run: |
-        if [[ "${{ github.head_ref }}" =~ release/[0-9]+\.[0-9]+\.[0-9]+-rc ]]; then
+        if [[ "$HEAD_REF" =~ release/[0-9]+\.[0-9]+\.[0-9]+-rc ]]; then
           echo "Branch name contains release/version-rc pattern. Merging is not allowed. Only stable release should be merge into master"
           exit 1
         fi
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   check-master-version:
     needs: check-rc-pattern
     runs-on: ubuntu-latest
     if: github.base_ref == 'master' && startsWith(github.head_ref, 'release')
     steps:
     - name: Checkout master branch
-      uses: actions/checkout@v4
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         ref: master
         path: master
     - name: Checkout release branch
-      uses: actions/checkout@v4
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         ref: ${{ github.head_ref }}
         path: release
     - name: Extract versions
       run: |
         MASTER_VERSION=$(grep 'target-version' master/package.json | awk '{print $2}' | tr -d '",')
         RELEASE_VERSION=$(grep 'target-version' release/package.json | awk '{print $2}' | tr -d '",')
-        echo "MASTER_VERSION=$MASTER_VERSION" >> $GITHUB_ENV
-        echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV
+        {
+          echo "MASTER_VERSION=$MASTER_VERSION"
+          echo "RELEASE_VERSION=$RELEASE_VERSION"
+        } >> "$GITHUB_ENV"
     - name: Compare versions
-      uses: jackbilestech/semver-compare@1.0.4
+      uses: jackbilestech/semver-compare@b6b063c569b77bea4a0ab627192cbdabf75de3f5 # 1.0.4
       with:
         head: ${{ env.RELEASE_VERSION }}
         base: ${{ env.MASTER_VERSION }}
-        operator: '>='
+        operator: '>='