Skip to content

Use new GH action to upload SDK version info #2222

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fnewberg merged 3 commits into from
Jun 2, 2025
Merged

Use new GH action to upload SDK version info #2222

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9e0e09a
use new action to upload SDK version info
fnewberg May 30, 2025
9c5aa68
pin action to a commit and removed unnecessary check
fnewberg May 30, 2025
fd4c3b6
Merge branch 'main' into fnewberg/use-upload-sdk-version-action
fnewberg Jun 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions .github/workflows/release-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,16 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 60
steps:
- name: Validate access to version data service
uses: embrace-io/public-actions/upload-sdk-version@f4229398f257b24dbbe8b873f78e719f9af6cbbb
Copy link
Copy Markdown
Contributor

@bidetofevil bidetofevil Jun 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is this pinned ID for?

Copy link
Copy Markdown
Contributor Author

@fnewberg fnewberg Jun 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that's the sha for the version of the upload-sdk-version action. GH warns you if you do anything less strict than that for 3rd party actions. this may seem like a bit of overkill, but is probably a response to attacks that have occurred in the past where people changed the behavior of public actions. even though we control the action, GH sees it as a 3rd party one

with:
platform: 'android'
version: ${{ inputs.rc_version }}
dryRun: true
sdkVersionUrl: ${{ vars.SDK_VERSION_URL }}
env:
SDK_VERSION_TOKEN: ${{ secrets.SDK_VERSION_TOKEN }}

- name: Checkout SDK
uses: actions/checkout@v4
with:
Expand All @@ -43,6 +53,16 @@ jobs:
run: |
./gradlew findSonatypeStagingRepository releaseSonatypeStagingRepository -Dorg.gradle.parallel=false --no-build-cache --no-configuration-cache --stacktrace

- name: Record SDK Version History
uses: embrace-io/public-actions/upload-sdk-version@f4229398f257b24dbbe8b873f78e719f9af6cbbb
with:
platform: 'android'
version: ${{ inputs.rc_version }}
dryRun: false
sdkVersionUrl: ${{ vars.SDK_VERSION_URL }}
env:
SDK_VERSION_TOKEN: ${{ secrets.SDK_VERSION_TOKEN }}

publish-api-docs:
name: Publish API Docs to GitHub Pages
uses: ./.github/workflows/publish-api-docs.yml
Expand Down
Loading