summaryrefslogtreecommitdiffhomepage
path: root/.github/workflows/android-audit.yml
AgeCommit message (Collapse)AuthorFilesLines
2025-08-28Use rust-android-gradle plugin as submoduleKalle Lindström1-0/+6
2025-03-20Add github action to verify dependency keysDavid Göransson1-8/+22
2025-02-19Ensure gradle lockfile is up-to-date in ciAlbin1-0/+5
2025-02-04Change run commands to single lineKalle Lindström1-2/+1
2025-02-04Remove OWASP dependency check pluginAlbin1-21/+0
The OWASP DependencyCheck plugin has been replaced with `osv-scanner` which covers our use-case.
2025-01-21Fix CIDavid Göransson1-0/+3
2024-11-26Update Actionstinyboxvk1-3/+3
Signed-off-by: tinyboxvk <13696594+tinyboxvk@users.noreply.github.com>
2024-11-04Exclude maybenot bundle check in lockfile scriptAlbin1-5/+0
2024-10-30Add back maybenot_machines version 1Joakim Hulthe1-1/+1
2024-09-17Fix ensure clean lockfile taskDavid Göransson1-0/+5
2024-08-22Add top level `permissions` to all Github Actions workflowsLinus Färnstrand1-0/+3
The default permission on the repository is already set to read only. So in practice this makes no difference. But this makes that more explicit, and less relying on the repository being correctly configured. This also makes security scanning tools such as OpenSSF scorecard happier about the overall security of our repository.
2024-08-15Refactor lockfile script and gradle tasksAlbin1-4/+0
2024-06-17Add action to ensure clean lockfileAlbin1-0/+31
2023-11-06Trigger android audit action on suppression updatesAlbin1-1/+5
2023-08-03Use container in audit actionAlbin1-3/+38
2023-06-01Add daily scheduled gradle audit checkAlbin1-0/+7
2023-06-01Set audit task action nameAlbin1-1/+2
2023-06-01Limit PR audit trigger path to gradle lockfileAlbin1-1/+1
2023-01-13Run yamlfix on all of .github/workflows/Linus Färnstrand1-12/+11
2022-10-18Update actions/checkout to v3Hank1-1/+1
2022-03-25Rename some Github Actions jobs to make them easier to findLinus Färnstrand1-1/+1
2022-01-12Change workflow trigger from push to pull_requestOskar Nyberg1-1/+1
2021-12-20Add Android dependency auditAlbin1-0/+15
Adds the OWASP Dependency-Check tool to the project to detect potentially vulnerable dependencies. Gradle is configured to skip the lintClassPath configuration, which relies on many dependencies that has been flagged to have CVEs, as it's related to the lint tooling rather than the project's compilation class path. The alternative would be to suppress specific CVEs, however that could potentially result in suppressed CVEs in project compilation class path.