From b459cd0797445a8e086df840937702458aef06ed Mon Sep 17 00:00:00 2001
From: Dipen Pradhan <dipenpradhan13@gmail.com>
Date: Sun, 7 Jun 2026 14:37:36 -0700
Subject: [PATCH] ci: harden GitHub Actions workflows

- Replace archived marvinpinto/action-automatic-releases@latest
  (mutable tag, token access) with softprops/action-gh-release
  pinned to a commit SHA
- Add least-privilege permissions blocks to android.yml, build.yml
  and master-apk-create.yml (default token was write-all)
- Add a Gradle wrapper validation workflow (checksums of
  gradle-wrapper.jar verified against official distributions)

Refs #215
---
 .github/workflows/android.yml            |  3 +
 .github/workflows/build.yml              |  2 +
 .github/workflows/master-apk-create.yml  | 71 +++++++++---------------
 .github/workflows/wrapper-validation.yml | 22 ++++++++
 4 files changed, 53 insertions(+), 45 deletions(-)
 create mode 100644 .github/workflows/wrapper-validation.yml

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 88634bcd..23ac9e2d 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e8368f08..ed1b6dd2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -9,6 +9,8 @@ on:
     
   workflow_dispatch:
 
+permissions:
+  contents: read
 
 jobs:
 
diff --git a/.github/workflows/master-apk-create.yml b/.github/workflows/master-apk-create.yml
index ed162e22..db9a16c5 100644
--- a/.github/workflows/master-apk-create.yml
+++ b/.github/workflows/master-apk-create.yml
@@ -1,59 +1,40 @@
 name: Create APK from Main
 
 on:
-
   push:
-
     branches:
+      - master
 
-    - master
+# The release job updates the rolling "latest-master" prerelease.
+permissions:
+  contents: write
 
 jobs:
-
   build:
-
     runs-on: ubuntu-latest
 
     steps:
-
-    - uses: actions/checkout@v4
-
-    - name: set up JDK 17
-
-      uses: actions/setup-java@v4
-
-      with:
-
-        java-version: '17'
-
-        distribution: 'temurin'
-
-        cache: gradle
-
-    - name: Grant execute permission for gradlew
-
-      run: chmod +x gradlew
-
-      
-
-    - name: Build APK ⚙️🛠
-
-      run: bash ./gradlew assembleDebug
-
- 
-
-    - uses: "marvinpinto/action-automatic-releases@latest"
-
-      with:
-
-          repo_token: "${{ github.token }}"
-
-          automatic_release_tag: "latest-master"
-
+      - uses: actions/checkout@v4
+
+      - name: set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: gradle
+
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+
+      - name: Build APK ⚙️🛠
+        run: bash ./gradlew assembleDebug
+
+      # Pinned to a commit SHA: third-party action with access to GITHUB_TOKEN.
+      # (Replaces the archived marvinpinto/action-automatic-releases@latest.)
+      - name: Update latest-master prerelease
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        with:
+          tag_name: latest-master
+          name: 'Staging Build'
           prerelease: true
-
-          title: "Staging Build"
-
           files: app/build/outputs/apk/debug/app-debug.apk
-
-      
diff --git a/.github/workflows/wrapper-validation.yml b/.github/workflows/wrapper-validation.yml
new file mode 100644
index 00000000..882cc299
--- /dev/null
+++ b/.github/workflows/wrapper-validation.yml
@@ -0,0 +1,22 @@
+name: Validate Gradle Wrapper
+
+# Verifies the checksums of all checked-in gradle-wrapper.jar files against
+# the official Gradle distribution checksums — a tampered wrapper JAR cannot
+# be spotted in code review.
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # Pinned to a commit SHA (third-party action).
+      - uses: gradle/actions/wrapper-validation@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0