Skip to content

Pin reactivecircus/android-emulator-runner#1100

Draft
ppkarwasz wants to merge 1 commit into
apache:mainfrom
ppkarwasz:feat/pin-android-emulator-runner
Draft

Pin reactivecircus/android-emulator-runner#1100
ppkarwasz wants to merge 1 commit into
apache:mainfrom
ppkarwasz:feat/pin-android-emulator-runner

Conversation

@ppkarwasz

Copy link
Copy Markdown
Member
  • Replaces the reactivecircus/android-emulator-runner@* wildcard with the v2.38.0 SHA (a421e438) as the permanent, Dependabot-maintained pin.
  • Whitelists the v2.37.0 and v2.34.0 SHAs and the floating v2 tag until 2026-08-25; remove_expired.yml will drop these automatically.
  • Composite action and approved_patterns.yml regenerated with the gateway sync.

Test plan: uv run pytest passes (544 passed, 5 skipped).

Repos to migrate before 2026-08-25

Using the floating v2 tag (11 repos):

Repo Workflow
apache/fory .github/workflows/ci.yml
apache/cordova-plugin-device .github/workflows/android.yml
apache/cordova-plugin-device-motion .github/workflows/android.yml
apache/cordova-plugin-device-orientation .github/workflows/android.yml
apache/cordova-plugin-dialogs .github/workflows/android.yml
apache/cordova-plugin-file .github/workflows/android.yml
apache/cordova-plugin-geolocation .github/workflows/android.yml
apache/cordova-plugin-media .github/workflows/android.yml
apache/cordova-plugin-media-capture .github/workflows/android.yml
apache/cordova-plugin-screen-orientation .github/workflows/android.yml
apache/cordova-plugin-statusbar .github/workflows/android.yml

Pinned to v2.37.0 (e89f39f1abbbd05b1113a29cf4db69e7540cae5a):

Repo Workflow
apache/cordova-plugin-inappbrowser .github/workflows/android.yml
apache/cordova-plugin-network-information .github/workflows/android.yml

Pinned to v2.34.0 (1dcd0090116d15e7c562f8db72807de5e036a4ed):

Repo Workflow
apache/cordova-plugin-vibration .github/workflows/android.yml

Already on the v2.38.0 SHA, no change needed: apache/commons-xml, apache/cordova-paramedic, apache/cordova-plugin-battery-status, apache/cordova-plugin-camera, apache/cordova-plugin-file-transfer.

🤖 Generated with Claude Code

Replace the wildcard with the v2.38.0 SHA as the permanent,
Dependabot-maintained pin. The v2.37.0 and v2.34.0 SHAs and the
floating v2 tag (still used by 14 apache repos) are whitelisted
until 2026-08-25 to give those repos time to migrate.

Generated-by: Claude Fable 5 (Claude Code)
@ppkarwasz
ppkarwasz marked this pull request as draft July 25, 2026 12:22
@ppkarwasz

Copy link
Copy Markdown
Member Author

I am converting this to draft, because there are two independent failures:

  1. Check action tags. Allow listing by tag isn't currently supported. I can skip this if 11 repos pin it by SHA1 instead of tag.
  2. Verify Manual Allowlist PR. On two occasions the action downloads external resources without verifying hashes:
    • One instance of tc.downloadTool (caught by our verifier),
    • One instance of shelling out to curl in the same file (not caught by our verifier).

This code is not executed on the GitHub runners, because they have a pre-installed ANDROID_HOME.

@erisu

erisu commented Jul 25, 2026

Copy link
Copy Markdown
Member

@ppkarwasz I submitted pull requests to each Cordova plugin repository to update the workflows, which will include updating of the pinned GitHub Action.

It will be set to the SHA1 of v2.38.0. E.g.:

reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0

Hopefully I'll have them merged in a day or two. I'll update when completed on our end.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants