Skip to content

Swap external action to verify changed files for inline code #6779

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 19, 2025

Conversation

rlazo
Copy link
Collaborator

@rlazo rlazo commented Mar 18, 2025

In the light of recent security issues, we are choosing to use our own code to replace an external action.

See
https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised for context

b/403703743

In the light of recent security issues, we are choosing to use our own
code to replace an external action.

See
https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
for context
@rlazo rlazo requested a review from daymxn March 18, 2025 05:08
Copy link
Contributor

github-actions bot commented Mar 18, 2025

📝 PRs merging into main branch

Our main branch should always be in a releasable state. If you are working on a larger change, or if you don't want this change to see the light of the day just yet, consider using a feature branch first, and only merge into the main branch when the code complete and ready to be released.

Copy link
Contributor

github-actions bot commented Mar 18, 2025

Test Results

 1 032 files  ±0   1 032 suites  ±0   34m 26s ⏱️ -4s
 5 861 tests ±0   5 839 ✅ ±0  22 💤 ±0  0 ❌ ±0 
11 785 runs  ±0  11 741 ✅ ±0  44 💤 ±0  0 ❌ ±0 

Results for commit 24b300d. ± Comparison against base commit 236df1f.

♻️ This comment has been updated with latest results.

@google-oss-bot
Copy link
Contributor

google-oss-bot commented Mar 18, 2025

@google-oss-bot
Copy link
Contributor

google-oss-bot commented Mar 18, 2025

Coverage Report 1

Affected Products

  • firebase-database

    Overall coverage changed from 50.16% (236df1f) to 50.22% (008119f) by +0.05%.

    FilenameBase (236df1f)Merge (008119f)Diff
    ChildChangeAccumulator.java83.33%96.67%+13.33%
    QueryParams.java89.76%90.36%+0.60%
    ViewProcessor.java91.79%92.10%+0.30%
    WriteTree.java77.22%76.67%-0.56%
  • firebase-firestore

    Overall coverage changed from 45.77% (236df1f) to 45.77% (008119f) by +0.00%.

    FilenameBase (236df1f)Merge (008119f)Diff
    DeleteMutation.java90.48%95.24%+4.76%
  • firebase-inappmessaging

    Overall coverage changed from ? (236df1f) to 39.03% (008119f) by ?.

    148 individual files with coverage change

    FilenameBase (236df1f)Merge (008119f)Diff
    AbtIntegrationHelper.java?60.87%?
    AbtIntegrationHelper_Factory.java?0.00%?
    Action.java?76.47%?
    Analytics.java?0.00%?
    AnalyticsConstants.java?0.00%?
    AnalyticsEventsManager.java?85.19%?
    AnalyticsEventsModule.java?0.00%?
    AnalyticsEventsModule_ProvidesAnalyticsConnectorEventsFactory.java?0.00%?
    AnalyticsEventsModule_ProvidesAnalyticsEventsManagerFactory.java?0.00%?
    AnalyticsListener.java?0.00%?
    ApiClient.java?100.00%?
    ApiClientModule.java?0.00%?
    ApiClientModule_ProvidesApiClientFactory.java?0.00%?
    ApiClientModule_ProvidesDataCollectionHelperFactory.java?0.00%?
    ApiClientModule_ProvidesFirebaseAppFactory.java?0.00%?
    ApiClientModule_ProvidesFirebaseInstallationsFactory.java?0.00%?
    ApiClientModule_ProvidesSharedPreferencesUtilsFactory.java?0.00%?
    ApiClientModule_ProvidesTestDeviceHelperFactory.java?0.00%?
    AppComponent.java?0.00%?
    AppForeground.java?0.00%?
    ApplicationModule.java?0.00%?
    ApplicationModule_DeveloperListenerManagerFactory.java?0.00%?
    ApplicationModule_ProvidesApplicationFactory.java?0.00%?
    AppMeasurementModule.java?0.00%?
    AppMeasurementModule_ProvidesAnalyticsConnectorFactory.java?0.00%?
    AppMeasurementModule_ProvidesSubsriberFactory.java?0.00%?
    AutoValue_InstallationIdResult.java?33.33%?
    AutoValue_RateLimit.java?44.68%?
    BannerMessage.java?75.00%?
    Button.java?61.76%?
    CampaignAnalytics.java?33.22%?
    CampaignAnalyticsOrBuilder.java?0.00%?
    CampaignCache.java?0.00%?
    CampaignCacheClient.java?88.00%?
    CampaignCacheClient_Factory.java?0.00%?
    CampaignImpression.java?38.96%?
    CampaignImpressionList.java?39.25%?
    CampaignImpressionListOrBuilder.java?0.00%?
    CampaignImpressionOrBuilder.java?0.00%?
    CampaignMetadata.java?100.00%?
    CampaignProto.java?27.23%?
    CardMessage.java?78.48%?
    ClientAppInfo.java?35.79%?
    ClientAppInfoOrBuilder.java?0.00%?
    Clock.java?0.00%?
    CommonTypesProto.java?9.87%?
    DaggerAppComponent.java?0.00%?
    DaggerUniversalComponent.java?0.00%?
    DataCollectionHelper.java?87.50%?
    DataCollectionHelper_Factory.java?0.00%?
    DeveloperListenerManager.java?100.00%?
    DismissType.java?82.61%?
    DisplayCallbacksFactory.java?100.00%?
    DisplayCallbacksFactory_Factory.java?0.00%?
    DisplayCallbacksImpl.java?93.46%?
    EventType.java?76.19%?
    ExecutorsModule.java?0.00%?
    ExecutorsModule_ProvidesBackgroundExecutorFactory.java?0.00%?
    ExecutorsModule_ProvidesBlockingExecutorFactory.java?0.00%?
    ExecutorsModule_ProvidesLightWeightExecutorFactory.java?0.00%?
    ExperimentPayloadProto.java?6.05%?
    FetchEligibleCampaignsRequest.java?32.98%?
    FetchEligibleCampaignsRequestOrBuilder.java?0.00%?
    FetchEligibleCampaignsResponse.java?42.86%?
    FetchEligibleCampaignsResponseOrBuilder.java?0.00%?
    FetchErrorReason.java?52.17%?
    FiamAnalyticsConnectorListener.java?100.00%?
    FiamFetchService.java?0.00%?
    FirebaseAppScope.java?0.00%?
    FirebaseInAppMessaging.java?80.60%?
    FirebaseInAppMessagingCampaignAnalyticsProto.java?0.00%?
    FirebaseInAppMessagingClickListener.java?0.00%?
    FirebaseInAppMessagingContextualTrigger.java?0.00%?
    FirebaseInAppMessagingDismissListener.java?0.00%?
    FirebaseInAppMessagingDisplay.java?0.00%?
    FirebaseInAppMessagingDisplayCallbacks.java?100.00%?
    FirebaseInAppMessagingDisplayErrorListener.java?0.00%?
    FirebaseInAppMessagingImpressionListener.java?0.00%?
    FirebaseInAppMessagingRegistrar.java?0.00%?
    FirebaseInAppMessaging_Factory.java?0.00%?
    ForegroundFlowableModule.java?0.00%?
    ForegroundFlowableModule_ProvidesAppForegroundEventStreamFactory.java?0.00%?
    ForegroundNotifier.java?76.00%?
    GrpcChannelModule.java?0.00%?
    GrpcChannelModule_ProvidesGrpcChannelFactory.java?0.00%?
    GrpcChannelModule_ProvidesServiceHostFactory.java?0.00%?
    GrpcClient.java?100.00%?
    GrpcClientModule.java?0.00%?
    GrpcClientModule_ProvidesApiKeyHeadersFactory.java?0.00%?
    GrpcClientModule_ProvidesInAppMessagingSdkServingStubFactory.java?0.00%?
    GrpcClient_Factory.java?0.00%?
    ImageData.java?71.43%?
    ImageOnlyMessage.java?75.86%?
    ImpressionStorageClient.java?100.00%?
    ImpressionStorageClient_Factory.java?0.00%?
    ImpressionStore.java?0.00%?
    InAppMessage.java?24.24%?
    InAppMessageStreamManager.java?91.40%?
    InAppMessageStreamManager_Factory.java?0.00%?
    InAppMessaging.kt?0.00%?
    InAppMessagingSdkServingGrpc.java?45.95%?
    InstallationIdResult.java?100.00%?
    Logging.java?0.00%?
    MessagesProto.java?36.03%?
    MessageType.java?100.00%?
    MetricsLoggerClient.java?94.29%?
    ModalMessage.java?74.07%?
    ProgramaticContextualTriggers.java?0.00%?
    ProgrammaticContextualTriggerFlowableModule.java?0.00%?
    ProgrammaticContextualTriggerFlowableModule_ProvidesProgramaticContextualTriggersFactory.java?0.00%?
    ProgrammaticContextualTriggerFlowableModule_ProvidesProgramaticContextualTriggerStreamFactory.java?0.00%?
    ProgrammaticTrigger.java?0.00%?
    ProtoMarshallerClient.java?91.40%?
    ProtoMarshallerClient_Factory.java?0.00%?
    ProtoStorageClient.java?100.00%?
    ProtoStorageClientModule.java?0.00%?
    ProtoStorageClientModule_ProvidesProtoStorageClientForCampaignFactory.java?0.00%?
    ProtoStorageClientModule_ProvidesProtoStorageClientForImpressionStoreFactory.java?0.00%?
    ProtoStorageClientModule_ProvidesProtoStorageClientForLimiterStoreFactory.java?0.00%?
    ProviderInstaller.java?37.50%?
    ProviderInstaller_Factory.java?0.00%?
    ProxyAnalyticsConnector.java?67.95%?
    RateLimit.java?0.00%?
    RateLimiterClient.java?100.00%?
    RateLimiterClient_Factory.java?0.00%?
    RateLimitModule.java?0.00%?
    RateLimitModule_ProvidesAppForegroundRateLimitFactory.java?0.00%?
    RateLimitProto.java?52.69%?
    RenderErrorReason.java?82.61%?
    SchedulerModule.java?0.00%?
    SchedulerModule_ProvidesComputeSchedulerFactory.java?0.00%?
    SchedulerModule_ProvidesIOSchedulerFactory.java?0.00%?
    SchedulerModule_ProvidesMainThreadSchedulerFactory.java?0.00%?
    Schedulers.java?87.50%?
    Schedulers_Factory.java?0.00%?
    SharedPreferencesUtils.java?40.35%?
    SharedPreferencesUtils_Factory.java?0.00%?
    SystemClock.java?100.00%?
    SystemClockModule.java?0.00%?
    SystemClockModule_ProvidesSystemClockModuleFactory.java?0.00%?
    SystemClock_Factory.java?0.00%?
    TestDeviceHelper.java?100.00%?
    TestDeviceHelper_Factory.java?0.00%?
    Text.java?67.74%?
    TransportClientModule.java?0.00%?
    TransportClientModule_ProvidesMetricsLoggerClientFactory.java?0.00%?
    TriggeredInAppMessage.java?100.00%?
    UniversalComponent.java?0.00%?

  • firebase-messaging

    Overall coverage changed from 84.13% (236df1f) to 84.02% (008119f) by -0.11%.

    FilenameBase (236df1f)Merge (008119f)Diff
    Metadata.java41.27%36.51%-4.76%
  • firebase-perf

    Overall coverage changed from ? (236df1f) to 70.62% (008119f) by ?.

    104 individual files with coverage change

    FilenameBase (236df1f)Merge (008119f)Diff
    AddTrace.java?0.00%?
    AndroidApplicationInfo.java?34.71%?
    AndroidApplicationInfoOrBuilder.java?0.00%?
    AndroidLogger.java?100.00%?
    AndroidMemoryReading.java?38.36%?
    AndroidMemoryReadingOrBuilder.java?0.00%?
    ApplicationInfo.java?45.00%?
    ApplicationInfoOrBuilder.java?0.00%?
    ApplicationProcessState.java?73.91%?
    AppStartTrace.java?77.55%?
    AppStateMonitor.java?85.55%?
    AppStateUpdateHandler.java?89.29%?
    Clock.java?100.00%?
    ConfigResolver.java?90.33%?
    ConfigurationConstants.java?97.93%?
    ConfigurationFlag.java?80.00%?
    ConsoleUrlGenerator.java?37.50%?
    Constants.java?95.65%?
    Counter.java?90.91%?
    CpuGaugeCollector.java?92.77%?
    CpuMetricReading.java?39.33%?
    CpuMetricReadingOrBuilder.java?0.00%?
    DaggerFirebasePerformanceComponent.java?100.00%?
    DeviceCacheManager.java?76.42%?
    FirebasePerfApplicationInfoValidator.java?92.86%?
    FirebasePerfEarly.java?76.92%?
    FirebasePerfGaugeMetricValidator.java?100.00%?
    FirebasePerfHttpClient.java?93.85%?
    FirebasePerfMetricProto.java?0.00%?
    FirebasePerfNetworkValidator.java?86.67%?
    FirebasePerfOkHttpClient.java?44.90%?
    FirebasePerformance.java?79.12%?
    FirebasePerformanceAttributable.java?0.00%?
    FirebasePerformanceComponent.java?0.00%?
    FirebasePerformanceInitializer.java?28.57%?
    FirebasePerformanceModule.java?100.00%?
    FirebasePerformanceModule_ProvidesConfigResolverFactory.java?0.00%?
    FirebasePerformanceModule_ProvidesFirebaseAppFactory.java?0.00%?
    FirebasePerformanceModule_ProvidesFirebaseInstallationsFactory.java?0.00%?
    FirebasePerformanceModule_ProvidesRemoteConfigComponentFactory.java?0.00%?
    FirebasePerformanceModule_ProvidesRemoteConfigManagerFactory.java?0.00%?
    FirebasePerformanceModule_ProvidesSessionManagerFactory.java?0.00%?
    FirebasePerformanceModule_ProvidesTransportFactoryProviderFactory.java?0.00%?
    FirebasePerformance_Factory.java?0.00%?
    FirebasePerfRegistrar.java?100.00%?
    FirebasePerfTraceValidator.java?85.87%?
    FirebasePerfUrlConnection.java?44.44%?
    FirstDrawDoneListener.java?85.71%?
    FlgTransport.java?83.33%?
    FragmentStateMonitor.java?94.87%?
    FrameMetricsCalculator.java?96.77%?
    FrameMetricsRecorder.java?76.32%?
    GaugeManager.java?98.40%?
    GaugeMetadata.java?26.17%?
    GaugeMetadataManager.java?77.78%?
    GaugeMetadataOrBuilder.java?0.00%?
    GaugeMetric.java?39.47%?
    GaugeMetricOrBuilder.java?0.00%?
    HttpMetric.java?92.65%?
    ImmutableBundle.java?100.00%?
    InstrHttpInputStream.java?92.45%?
    InstrHttpOutputStream.java?98.00%?
    InstrHttpsURLConnection.java?94.32%?
    InstrHttpURLConnection.java?93.42%?
    InstrumentApacheHttpResponseHandler.java?100.00%?
    InstrumentOkHttpEnqueueCallback.java?100.00%?
    InstrURLConnectionBase.java?94.86%?
    LogWrapper.java?23.08%?
    MemoryGaugeCollector.java?89.66%?
    NetworkConnectionInfo.java?0.00%?
    NetworkConnectionInfoOrBuilder.java?0.00%?
    NetworkRequestMetric.java?49.16%?
    NetworkRequestMetricBuilder.java?95.97%?
    NetworkRequestMetricBuilderUtil.java?75.00%?
    NetworkRequestMetricOrBuilder.java?0.00%?
    Optional.java?86.67%?
    PendingPerfEvent.java?100.00%?
    PerfMetric.java?33.67%?
    PerfMetricOrBuilder.java?0.00%?
    PerfMetricValidator.java?93.55%?
    Performance.kt?7.14%?
    PerfSession.java?93.22%?
    PerfSessionOrBuilder.java?0.00%?
    PreDrawListener.java?94.12%?
    Rate.java?100.00%?
    RateLimiter.java?90.77%?
    RemoteConfigManager.java?90.28%?
    ResourceType.java?0.00%?
    ScreenTraceUtil.java?94.12%?
    SessionAwareObject.java?0.00%?
    SessionManager.java?100.00%?
    SessionVerbosity.java?68.42%?
    StorageUnit.java?57.89%?
    Timer.java?90.63%?
    Trace.java?95.83%?
    TraceMetric.java?43.14%?
    TraceMetricBuilder.java?100.00%?
    TraceMetricOrBuilder.java?0.00%?
    TransportInfo.java?0.00%?
    TransportInfoOrBuilder.java?0.00%?
    TransportManager.java?94.88%?
    URLAllowlist.java?94.44%?
    URLWrapper.java?0.00%?
    Utils.java?78.57%?

  • firebase-storage

    Overall coverage changed from 84.33% (236df1f) to 83.96% (008119f) by -0.37%.

    FilenameBase (236df1f)Merge (008119f)Diff
    StorageException.java69.09%65.45%-3.64%
    StorageTask.java83.99%83.38%-0.60%
    UploadTask.java83.17%81.52%-1.65%

Test Logs

  1. https://storage.googleapis.com/firebase-sdk-metric-reports/iqNiBw9ehq.html

@rlazo rlazo enabled auto-merge (squash) March 19, 2025 17:02
@rlazo rlazo merged commit af1fe93 into main Mar 19, 2025
259 of 262 checks passed
@rlazo rlazo deleted the rl.replace.action.diff branch March 19, 2025 17:15
tejasd pushed a commit that referenced this pull request Apr 1, 2025
In the light of recent security issues, we are choosing to use our own
code to replace an external action.

See

https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
for context

b/403703743
@firebase firebase locked and limited conversation to collaborators Apr 19, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants