Sedat Qaja 2a79103060 ci(release): pin the actions and keep inputs out of the shell ...

zizmor flags the HealthChat release workflow now that the rebase PR shows
the whole file as new: five actions referenced by floating major tags, the
workflow_dispatch version input expanded straight into a shell script, and
a Gradle cache on a release build.

- Pin checkout, setup-java, setup-gradle, upload-artifact and
  upload-google-play to commit SHAs with their version in a comment, the
  way every upstream workflow does.
- Pass the version input through the environment instead of expanding it
  into the run script.
- Disable the Gradle cache for the release build so a poisoned cache from
  another workflow cannot reach the signed bundle.

2026-10-19 16:42:35 +02:00

..

ISSUE_TEMPLATE

Fix typo

2026-07-08 10:02:04 +02:00

workflows

ci(release): pin the actions and keep inputs out of the shell

2026-10-19 16:42:35 +02:00

dependabot.yml

Apply zizmor autofix

2026-03-05 15:39:54 +01:00

pull_request_template.md

Add Stefan's etiquette to the project. (#6909)

2026-05-29 15:59:54 +02:00

release.yml

Group Element Pro changes into a dedicated release notes section

2026-07-17 14:21:11 +02:00

renovate.json5

Tweak renovate config again to avoid rate-limits in Maven Central (#7794)

2026-09-28 15:33:36 +02:00