zizmor flags the HealthChat release workflow now that the rebase PR shows
the whole file as new: five actions referenced by floating major tags, the
workflow_dispatch version input expanded straight into a shell script, and
a Gradle cache on a release build.
- Pin checkout, setup-java, setup-gradle, upload-artifact and
upload-google-play to commit SHAs with their version in a comment, the
way every upstream workflow does.
- Pass the version input through the environment instead of expanding it
into the run script.
- Disable the Gradle cache for the release build so a poisoned cache from
another workflow cannot reach the signed bundle.
Squash of ten CI commits from 2026-08-04 (all part of HealthChat release 26.08.0):
- ci(release): move releases to the persistent self-hosted runners
- ci: grant contents:read so checkout works on this private fork
- ci: disable the Label Community PRs job on this fork
- ci: run the heavy Gradle jobs on the self-hosted runners
- ci: rely on the runner image for the Android SDK
- ci: size the Gradle heap for the self-hosted containers
- ci: report runner capacity on the self-hosted jobs
- ci: record why the Gradle heap is reduced
- ci: cap Gradle workers so test JVMs fit the container
- ci: skip the codecov upload when no token is configured
The danger.yml hunk from the contents:read commit is omitted: upstream
replaced Danger with a github-script workflow in v26.09.
Sedat Qaja
joel.poyet