ci: harden workflows — least-privilege tokens, SHA-pinned release action, wrapper validation

.github/workflows/android.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 

.github/workflows/build.yml

@@ -9,6 +9,8 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  contents: read
 
 jobs:
 

.github/workflows/master-apk-create.yml

@@ -1,59 +1,40 @@
 name: Create APK from Main
 
 on:
-
   push:
-
     branches:
+      - master
 
-    - master
+# The release job updates the rolling "latest-master" prerelease.
+permissions:
+  contents: write
 
 jobs:
-
   build:
-
     runs-on: ubuntu-latest
 
     steps:
-
-    - uses: actions/checkout@v4
-
-    - name: set up JDK 17
-
-      uses: actions/setup-java@v4
-
-      with:
-
-        java-version: '17'
-
-        distribution: 'temurin'
-
-        cache: gradle
-
-    - name: Grant execute permission for gradlew
-
-      run: chmod +x gradlew
-
-
-
-    - name: Build APK ⚙️🛠
-
-      run: bash ./gradlew assembleDebug
-
-
-
-    - uses: "marvinpinto/action-automatic-releases@latest"
-
-      with:
-
-          repo_token: "${{ github.token }}"
-
-          automatic_release_tag: "latest-master"
-
+      - uses: actions/checkout@v4
+
+      - name: set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: gradle
+
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+
+      - name: Build APK ⚙️🛠
+        run: bash ./gradlew assembleDebug
+
+      # Pinned to a commit SHA: third-party action with access to GITHUB_TOKEN.
+      # (Replaces the archived marvinpinto/action-automatic-releases@latest.)
+      - name: Update latest-master prerelease
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        with:
+          tag_name: latest-master
+          name: 'Staging Build'
           prerelease: true
-
-          title: "Staging Build"
-
           files: app/build/outputs/apk/debug/app-debug.apk
-
-

.github/workflows/wrapper-validation.yml

@@ -0,0 +1,22 @@
+name: Validate Gradle Wrapper
+
+# Verifies the checksums of all checked-in gradle-wrapper.jar files against
+# the official Gradle distribution checksums — a tampered wrapper JAR cannot
+# be spotted in code review.
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # Pinned to a commit SHA (third-party action).
+      - uses: gradle/actions/wrapper-validation@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0