Repo tuneup (#1400)

2026-10-22 02:53:19 -05:00 · 2024-06-20 17:08:07 +01:00
1 parent 8e69719f6b
commit 49ca4848d1
@@ -0,0 +1,68 @@
+name: Android Bug Report
+description: File a bug report
+labels: [ bug ]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report!
+
+        Please do not submit feature requests. The [Community Forums](https://community.bitwarden.com) has a section for submitting, voting for, and discussing product feature requests.
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps To Reproduce
+      description: How can we reproduce the behavior.
+      value: |
+        1. Go to '...'
+        2. Click on '...'
+        3. Scroll down to '...'
+        4. Click on '...'
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Result
+      description: A clear and concise description of what you expected to happen.
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual Result
+      description: A clear and concise description of what is happening.
+    validations:
+      required: true
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots or Videos
+      description: If applicable, add screenshots and/or a short video to help explain your problem.
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional Context
+      description: Add any other context about the problem here.
+  - type: input
+    id: version
+    attributes:
+      label: Build Version
+      description: What version of our software are you running?
+    validations:
+      required: true
+  - type: textarea
+    id: environment-details
+    attributes:
+      label: Environment Details
+      placeholder: |
+        - Device: [e.g. Pixel Tablet, Samsung Galaxy S24 ]
+        - OS Version: [e.g. API 32, Tiramisu ]
+  - type: checkboxes
+    id: issue-tracking-info
+    attributes:
+      label: Issue Tracking Info
+      description: |
+        Issue tracking information
+      options:
+        - label: I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
@@ -10,10 +10,6 @@

 <!-- Required for any UI changes; delete if not applicable. Use fixed width images for better display. -->

-| Before | After |
-| --- | --- |
-|  |  |
-
 ## ⏰ Reminders before review

 - Contributor guidelines followed
@@ -1,35 +1,17 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "github>bitwarden/renovate-config"
-  ],
-  "enabledManagers": [
-    "github-actions",
-    "gradle",
-    "bundler"
-  ],
-  "commitMessagePrefix": "[deps]:",
-  "commitMessageTopic": "{{depName}}",
+  "extends": ["github>bitwarden/renovate-config"],
+  "enabledManagers": ["github-actions", "gradle", "bundler"],
  "packageRules": [
    {
      "groupName": "gh minor",
-      "matchManagers": [
-        "github-actions"
-      ],
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ]
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch"]
    },
    {
      "groupName": "gradle minor",
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ],
-      "matchManagers": [
-        "gradle"
-      ]
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchManagers": ["gradle"]
    },
    {
      "groupName": "kotlin",
@@ -39,19 +21,12 @@
        "org.jetbrains.kotlin.*",
        "com.google.devtools.ksp"
      ],
-      "matchManagers": [
-        "gradle"
-      ]
+      "matchManagers": ["gradle"]
    },
    {
      "groupName": "bundler minor",
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ],
-      "matchManagers": [
-        "bundler"
-      ]
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchManagers": ["bundler"]
    }
  ]
 }
@@ -1,55 +1,43 @@
---
-name: Main Build
+name: Build

 on:
  workflow_dispatch:
    inputs:
      version-name:
-        description: 'Optional. Version string to use, in X.Y.Z format. Overrides default in the project.'
+        description: "Optional. Version string to use, in X.Y.Z format. Overrides default in the project."
        required: false
        type: string
      version-code:
-        description: 'Optional. Build number to use. Overrides default of GitHub run number.'
+        description: "Optional. Build number to use. Overrides default of GitHub run number."
        required: false
        type: number
      distribute-to-firebase:
-        description: 'Optional. Distribute artifacts to Firebase.'
+        description: "Optional. Distribute artifacts to Firebase."
        required: false
        default: false
        type: boolean
      publish-to-play-store:
-        description: 'Optional. Deploy bundle artifact to Google Play Store'
+        description: "Optional. Deploy bundle artifact to Google Play Store"
        required: false
        default: false
        type: boolean

 env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  JAVA_VERSION: 17

 jobs:
-
-  # Job responsible for compiling the project and running checks
  build:
    name: Build
    runs-on: ubuntu-22.04
+
    steps:
-
-      # Checkout project.
-      - name: Checkout
+      - name: Check out repo
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
-        with:
-          fetch-depth: 0
-          # Allow subsequent steps to trigger GitHub Actions via git push
-          # https://github.community/t/push-from-action-even-with-pat-does-not-trigger-action/17622
-          persist-credentials: false

-      # Validate the gradle wrapper is known and not corrupted.
-      - name: Validate Gradle Wrapper
+      - name: Validate Gradle wrapper
        uses: gradle/wrapper-validation-action@b5418f5a58f5fd2eb486dd7efb368fe7be7eae45 # v2.1.3

-      # Configure gradle caching
-      - name: Cache Gradle Files
+      - name: Cache Gradle files
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: |
@@ -59,7 +47,6 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-gradle-v2-

-      # Configure build output caching
      - name: Cache build output
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
@@ -69,76 +56,60 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-build-

-      # Set the default JDK version.
      - name: Configure JDK
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with:
-          distribution: 'temurin'
+          distribution: "temurin"
          java-version: ${{ env.JAVA_VERSION }}

-      # Install required Ruby language version.
      - name: Configure Ruby
        uses: ruby/setup-ruby@943103cae7d3f1bb1e4951d5fcc7928b40e4b742 # v1.177.1
        with:
          bundler-cache: true

-      # Install fastlane CLI and dependencies.
      - name: Install Fastlane
        run: |
          gem install bundler:2.2.27
          bundle config path vendor/bundle
          bundle install --jobs 4 --retry 3

-      # Perform build checks, which include code analysis and test execution.
      - name: Check
        run: bundle exec fastlane test

-      # Compile project debug artifacts.
      - name: Build
        run: bundle exec fastlane assembleDebugApks

  publish_playstore:
-    name: Publish PlayStore Artifacts
+    name: Publish Play Store artifacts
    needs:
      - build
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
-        variant: [ "prod", "qa" ]
-        artifact: [ "apk", "aab" ]
+        variant: ["prod", "qa"]
+        artifact: ["apk", "aab"]
    steps:
-
-      # Checkout project
-      - name: Checkout
+      - name: Check out repo
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
-        with:
-          fetch-depth: 0
-          # Allow subsequent steps to trigger GitHub Actions via git push
-          # https://github.community/t/push-from-action-even-with-pat-does-not-trigger-action/17622
-          persist-credentials: false

-      # Install Ruby
      - name: Configure Ruby
        uses: ruby/setup-ruby@943103cae7d3f1bb1e4951d5fcc7928b40e4b742 # v1.177.1
        with:
          bundler-cache: true

-      # Install Fastlane
      - name: Install Fastlane
        run: |
          gem install bundler:2.2.27
          bundle config path vendor/bundle
          bundle install --jobs 4 --retry 3

-      # Login to Azure
-      - name: Login to Azure - CI Subscription
+      - name: Log in to Azure
        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
        with:
          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

-      # Download keys and secrets needed for signing release and beta builds
-      - name: Download secrets
+      - name: Retrieve secrets
        env:
          ACCOUNT_NAME: bitwardenci
          CONTAINER_NAME: mobile
@@ -161,10 +132,8 @@ jobs:
          --name google-services.json --file ${{ github.workspace }}/app/src/standardRelease/google-services.json --output none
          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name google-services.json --file ${{ github.workspace }}/app/src/standardBeta/google-services.json --output none
-        shell: bash

-      # Download Firebase credentials for publishing to App Distribution on 'prod' variants.
-      - name: Download Firebase Credentials
+      - name: Download Firebase credentials
        if: ${{ matrix.variant == 'prod' && inputs.distribute-to-firebase }}
        env:
          ACCOUNT_NAME: bitwardenci
@@ -174,14 +143,11 @@ jobs:

          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_play_prod_firebase-creds.json --file ${{ github.workspace }}/secrets/app_play_prod_firebase-creds.json --output none
-        shell: bash

-      # Validate the gradle wrapper is known and not corrupted.
-      - name: Validate Gradle Wrapper
+      - name: Validate Gradle wrapper
        uses: gradle/wrapper-validation-action@b5418f5a58f5fd2eb486dd7efb368fe7be7eae45 # v2.1.3

-        # Configure gradle caching
-      - name: Cache Gradle Files
+      - name: Cache Gradle files
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: |
@@ -191,7 +157,6 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-gradle-v2-

-      # Configure build output caching
      - name: Cache build output
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
@@ -201,25 +166,20 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-build-

-      # Set default JDK
      - name: Configure JDK
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with:
-          distribution: 'temurin'
+          distribution: "temurin"
          java-version: ${{ env.JAVA_VERSION }}

-      # Set the latest build version information. Start from 11000 to prevent collisions with mobile
-      # build version codes.
      - name: Increment version
        run: |
          DEFAULT_VERSION_CODE=$((11000+$GITHUB_RUN_NUMBER))
          bundle exec fastlane setBuildVersionInfo \
          versionCode:${{ inputs.version-code || '$DEFAULT_VERSION_CODE' }} \
          versionName:${{ inputs.version-name }}
-        shell: bash

-      # Generate the Release Play Store Bundle (AAB) when building 'prod' variants.
-      - name: Generate Release Play Store Bundle
+      - name: Generate release Play Store bundle
        if: ${{ matrix.variant == 'prod' && matrix.artifact == 'aab' }}
        env:
          UPLOAD_KEYSTORE_PASSWORD: ${{ secrets.UPLOAD_KEYSTORE_PASSWORD }}
@@ -229,10 +189,8 @@ jobs:
          storePassword:${{ env.UPLOAD_KEYSTORE_PASSWORD }} \
          keyAlias:upload \
          keyPassword:${{ env.UPLOAD_KEYSTORE_PASSWORD }}
-        shell: bash

-      # Generate the Beta Play Store Bundle (AAB) when building 'prod' variants.
-      - name: Generate Beta Play Store Bundle
+      - name: Generate beta Play Store bundle
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
        env:
          UPLOAD_BETA_KEYSTORE_PASSWORD: ${{ secrets.UPLOAD_BETA_KEYSTORE_PASSWORD }}
@@ -243,10 +201,8 @@ jobs:
          storePassword:${{ env.UPLOAD_BETA_KEYSTORE_PASSWORD }} \
          keyAlias:bitwarden-beta-upload \
          keyPassword:${{ env.UPLOAD_BETA_KEY_PASSWORD }}
-        shell: bash

-      # Generate the Release Play Store APK when building 'prod' variants.
-      - name: Generate Release Play Store APK
+      - name: Generate release Play Store APK
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
        env:
          PLAY_KEYSTORE_PASSWORD: ${{ secrets.PLAY_KEYSTORE_PASSWORD }}
@@ -256,10 +212,8 @@ jobs:
          storePassword:${{ env.PLAY_KEYSTORE_PASSWORD }} \
          keyAlias:bitwarden \
          keyPassword:${{ env.PLAY_KEYSTORE_PASSWORD }}
-        shell: bash

-      # Generate the Beta Play Store APK when building 'prod' variants.
-      - name: Generate Beta Play Store APK
+      - name: Generate beta Play Store APK
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
        env:
          PLAY_BETA_KEYSTORE_PASSWORD: ${{ secrets.PLAY_BETA_KEYSTORE_PASSWORD }}
@@ -270,16 +224,13 @@ jobs:
          storePassword:${{ env.PLAY_BETA_KEYSTORE_PASSWORD }} \
          keyAlias:bitwarden-beta \
          keyPassword:${{ env.PLAY_BETA_KEY_PASSWORD }}
-        shell: bash

-      # Generate debug version of the Play Store APKs when building variants other than 'prod'.
-      - name: Generate PlayStore QA APKs
+      - name: Generate QA Play Store APKs
        if: ${{ (matrix.variant != 'prod') && (matrix.artifact == 'apk') }}
        run: |
          bundle exec fastlane assembleDebugApks

-      # Upload Release Play Store AAB to GitHub workflow artifacts when building 'prod' variants.
-      - name: Upload Release Play Store .aab artifact
+      - name: Upload release Play Store .aab artifact
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
@@ -287,8 +238,7 @@ jobs:
          path: app/build/outputs/bundle/standardRelease/com.x8bit.bitwarden-standard-release.aab
          if-no-files-found: error

-      # Upload Play Store Beta AAB to GitHub workflow artifacts when building 'prod' variants.
-      - name: Upload Beta Play Store .aab artifact
+      - name: Upload beta Play Store .aab artifact
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
@@ -296,8 +246,7 @@ jobs:
          path: app/build/outputs/bundle/standardBeta/com.x8bit.bitwarden-standard-beta.aab
          if-no-files-found: error

-      # Upload Play Store Release APK to GitHub workflow artifacts when building 'prod' variants.
-      - name: Upload Release .apk artifact
+      - name: Upload release .apk artifact
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
@@ -305,8 +254,7 @@ jobs:
          path: app/build/outputs/apk/standard/release/com.x8bit.bitwarden-standard-release.apk
          if-no-files-found: error

-      # Upload Play Store Beta APK to GitHub workflow artifacts when building 'prod' variants.
-      - name: Upload Beta .apk artifact
+      - name: Upload beta .apk artifact
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
@@ -314,8 +262,8 @@ jobs:
          path: app/build/outputs/apk/standard/beta/com.x8bit.bitwarden-standard-beta.apk
          if-no-files-found: error

-      # Upload Play Store debug APK to GitHub workflow artifacts when building variants other than 'prod'.
-      - name: Upload Other .apk artifact
+      # When building variants other than 'prod'
+      - name: Upload other .apk artifact
        if: ${{ (matrix.variant != 'prod') && (matrix.artifact == 'apk') }}
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
@@ -323,43 +271,37 @@ jobs:
          path: app/build/outputs/apk/standard/debug/com.x8bit.bitwarden-standard-debug.apk
          if-no-files-found: error

-      # Generate SHA256 file for Release Play Store APK when building 'prod' variants.
-      - name: Create checksum for Release .apk artifact
+      - name: Create checksum for release .apk artifact
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
        run: |
          sha256sum "app/build/outputs/apk/standard/release/com.x8bit.bitwarden-standard-release.apk" \
            > ./bw-android-apk-sha256.txt

-      # Generate SHA256 file for Beta Play Store APK when building 'prod' variants.
-      - name: Create checksum for Beta .apk artifact
+      - name: Create checksum for beta .apk artifact
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
        run: |
          sha256sum "app/build/outputs/apk/standard/beta/com.x8bit.bitwarden-standard-beta.apk" \
            > ./bw-android-beta-apk-sha256.txt

-      # Generate SHA256 file for Release Play Store bundle (AAB) when building 'prod' variants.
-      - name: Create checksum for Release .aab artifact
+      - name: Create checksum for release .aab artifact
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
        run: |
          sha256sum "app/build/outputs/bundle/standardRelease/com.x8bit.bitwarden-standard-release.aab" \
            > ./bw-android-aab-sha256.txt

-      # Generate SHA256 file for Beta Play Store bundle (AAB) when building 'prod' variants.
-      - name: Create checksum for Beta .aab artifact
+      - name: Create checksum for beta .aab artifact
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
        run: |
          sha256sum "app/build/outputs/bundle/standardBeta/com.x8bit.bitwarden-standard-beta.aab" \
            > ./bw-android-beta-aab-sha256.txt

-      # Generate SHA256 file for debug Play Store APK when building variants other than 'prod'.
-      - name: Create checksum for Other .apk artifact
+      - name: Create checksum for other .apk artifact
        if: ${{ (matrix.variant != 'prod') && (matrix.artifact == 'apk') }}
        run: |
          sha256sum "app/build/outputs/apk/standard/debug/com.x8bit.bitwarden-standard-debug.apk" \
           > ./bw-android-${{ matrix.variant }}-apk-sha256.txt

-      # Upload SHA256 file for Release Play Store APK when building 'prod' variants.
-      - name: Upload .apk sha file for Release
+      - name: Upload .apk SHA file for release
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
@@ -367,8 +309,7 @@ jobs:
          path: ./bw-android-apk-sha256.txt
          if-no-files-found: error

-      # Upload SHA256 file for Beta Play Store APK when building 'prod' variants.
-      - name: Upload .apk sha file for Beta
+      - name: Upload .apk SHA file for beta
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
@@ -376,8 +317,7 @@ jobs:
          path: ./bw-android-beta-apk-sha256.txt
          if-no-files-found: error

-      # Upload SHA256 file for Release Play Store bundle (AAB) when building 'prod' variants.
-      - name: Upload .aab sha file for Release
+      - name: Upload .aab SHA file for release
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
@@ -385,8 +325,7 @@ jobs:
          path: ./bw-android-aab-sha256.txt
          if-no-files-found: error

-      # Upload SHA256 file for Beta Play Store bundle (AAB) when building 'prod' variants.
-      - name: Upload .aab sha file for Beta
+      - name: Upload .aab SHA file for beta
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
@@ -394,8 +333,7 @@ jobs:
          path: ./bw-android-beta-aab-sha256.txt
          if-no-files-found: error

-      # Upload SHA256 file for Play Store debug APK when building variants other than 'prod'.
-      - name: Upload .apk sha file for other
+      - name: Upload .apk SHA file for other
        if: ${{ (matrix.variant != 'prod') && (matrix.artifact == 'apk') }}
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
@@ -403,82 +341,61 @@ jobs:
          path: ./bw-android-${{ matrix.variant }}-apk-sha256.txt
          if-no-files-found: error

-      # Install Fastlane's Firebase App Distribution plugin when building 'prod' variants.
-      - name: Install Firebase App Distribution plugin
+      - name: Install Firebase app distribution plugin
        if: ${{ matrix.variant == 'prod' && github.ref_name == 'main' && inputs.distribute-to-firebase }}
        run: bundle exec fastlane add_plugin firebase_app_distribution

-      # Publish Release Play Store artifacts to Firebase.
-      - name: Publish Release artifacts to Firebase
+      - name: Publish release artifacts to Firebase
        if: ${{ matrix.variant == 'prod' && matrix.artifact == 'apk' && github.ref_name == 'main' && inputs.distribute-to-firebase }}
        env:
          APP_PLAY_FIREBASE_CREDS_PATH: ${{ github.workspace }}/secrets/app_play_prod_firebase-creds.json
        run: |
          bundle exec fastlane distributeReleasePlayStoreToFirebase \
          service_credentials_file:${{ env.APP_PLAY_FIREBASE_CREDS_PATH }}
-        shell: bash

-      # Publish Beta Play Store artifacts to Firebase.
-      - name: Publish Beta artifacts to Firebase
+      - name: Publish beta artifacts to Firebase
        if: ${{ (matrix.variant == 'prod' && matrix.artifact == 'apk') && github.ref_name == 'main' && inputs.distribute-to-firebase }}
        env:
          APP_PLAY_FIREBASE_CREDS_PATH: ${{ github.workspace }}/secrets/app_play_prod_firebase-creds.json
        run: |
          bundle exec fastlane distributeBetaPlayStoreToFirebase \
          service_credentials_file:${{ env.APP_PLAY_FIREBASE_CREDS_PATH }}
-        shell: bash

-      # Verify play store creds are valid for publication
-      - name: Verify Play Store creds
+      - name: Verify Play Store credentials
        if: ${{ matrix.variant == 'prod' && inputs.publish-to-play-store }}
        run: |
          bundle exec fastlane run validate_play_store_json_key
-        shell: bash

-        # Publish the Play Store bundle (AAB) to Google Play Store Internal testing track.
-      - name: Publish Play Store bundle to Play Store
+      - name: Publish Play Store bundle
        if: ${{ matrix.variant == 'prod' && inputs.publish-to-play-store }}
        run: bundle exec fastlane publishForInternalTesting
-        shell: bash

  publish_fdroid:
-    name: Publish FDroid Artifacts
-    # Job dependencies ignored while troubleshooting publish jobs.
+    name: Publish F-Droid artifacts
    needs:
      - build
    runs-on: ubuntu-22.04
    steps:
-
-      # Checkout project
-      - name: Checkout
+      - name: Check out repo
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
-        with:
-          fetch-depth: 0
-          # Allow subsequent steps to trigger GitHub Actions via git push
-          # https://github.community/t/push-from-action-even-with-pat-does-not-trigger-action/17622
-          persist-credentials: false

-      # Configure Ruby
      - name: Configure Ruby
        uses: ruby/setup-ruby@943103cae7d3f1bb1e4951d5fcc7928b40e4b742 # v1.177.1
        with:
          bundler-cache: true

-      # Install fastlane
      - name: Install Fastlane
        run: |
          gem install bundler:2.2.27
          bundle config path vendor/bundle
          bundle install --jobs 4 --retry 3

-      # Azure login
-      - name: Login to Azure - CI Subscription
+      - name: Log in to Azure
        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
        with:
          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

-      # Download F-Droid secrets
-      - name: Download secrets
+      - name: Retrieve secrets
        env:
          ACCOUNT_NAME: bitwardenci
          CONTAINER_NAME: mobile
@@ -487,10 +404,8 @@ jobs:
          --name app_fdroid-keystore.jks --file ${{ github.workspace }}/keystores/app_fdroid-keystore.jks --output none
          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_beta_fdroid-keystore.jks --file ${{ github.workspace }}/keystores/app_beta_fdroid-keystore.jks --output none
-        shell: bash

-      # Download Firebase credentials for publishing to App Distribution.
-      - name: Download Firebase Credentials
+      - name: Download Firebase credentials
        if: ${{ inputs.distribute-to-firebase }}
        env:
          ACCOUNT_NAME: bitwardenci
@@ -500,14 +415,11 @@ jobs:

          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_fdroid_firebase-creds.json --file ${{ github.workspace }}/secrets/app_fdroid_firebase-creds.json --output none
-        shell: bash

-      # Verify the gradle wrapper is known and not corrupted
-      - name: Validate Gradle Wrapper
+      - name: Validate Gradle wrapper
        uses: gradle/wrapper-validation-action@b5418f5a58f5fd2eb486dd7efb368fe7be7eae45 # v2.1.3

-        # Configure gradle caching
-      - name: Cache Gradle Files
+      - name: Cache Gradle files
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: |
@@ -517,7 +429,6 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-gradle-v2-

-      # Configure build output caching
      - name: Cache build output
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
@@ -527,15 +438,13 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-build-

-      # Set the JDK to be used
      - name: Configure JDK
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with:
-          distribution: 'temurin'
+          distribution: "temurin"
          java-version: ${{ env.JAVA_VERSION }}

-      # Bump the build version name and version code. Start from 11000 to prevent collisions with
-      # mobile build version codes.
+      # Start from 11000 to prevent collisions with mobile build version codes
      - name: Increment version
        run: |
          DEFAULT_VERSION_CODE=$((11000+$GITHUB_RUN_NUMBER))
@@ -543,8 +452,7 @@ jobs:
          versionCode:${{ inputs.version-code || '$DEFAULT_VERSION_CODE' }} \
          versionName:${{ inputs.version-name || '' }}

-      # Generate the F-Droid APK for publishing
-      - name: Generate F-Droid Artifacts
+      - name: Generate F-Droid artifacts
        env:
          FDROID_STORE_PASSWORD: ${{ secrets.FDROID_KEYSTORE_PASSWORD }}
        run: |
@@ -553,7 +461,7 @@ jobs:
          storePassword:"${{ env.FDROID_STORE_PASSWORD }}" \
          keyAlias:bitwarden \
          keyPassword:"${{ env.FDROID_STORE_PASSWORD }}"
-          
+
            # Generate the F-Droid APK for publishing
      - name: Generate F-Droid Beta Artifacts
        env:
@@ -566,7 +474,6 @@ jobs:
          keyAlias:bitwarden-beta \
          keyPassword:"${{ env.FDROID_BETA_KEY_PASSWORD }}"

-      # Upload F-Droid APK to GitHub workflow artifacts container
      - name: Upload F-Droid .apk artifact
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
@@ -574,30 +481,25 @@ jobs:
          path: app/build/outputs/apk/fdroid/release/com.x8bit.bitwarden-fdroid-release.apk
          if-no-files-found: error

-      # Generate checksum for F-Droid ARK verification
      - name: Create checksum for F-Droid artifact
        run: |
          sha256sum "app/build/outputs/apk/fdroid/release/com.x8bit.bitwarden-fdroid-release.apk" \
          > ./bw-fdroid-apk-sha256.txt

-      # Upload F-Droid checksum file to GitHub workflow artifacts container
-      - name: Upload F-Droid sha file
+      - name: Upload F-Droid SHA file
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
          name: bw-fdroid-apk-sha256.txt
          path: ./bw-fdroid-apk-sha256.txt
          if-no-files-found: error

-      # Install Fastlane's Firebase App Distribution plugin when building 'prod' variants.
-      - name: Install Firebase App Distribution plugin
+      - name: Install Firebase app distribution plugin
        run: bundle exec fastlane add_plugin firebase_app_distribution

-      # Publish Release F-Droid artifacts to Firebase.
-      - name: Publish Release F-Droid artifacts to Firebase
+      - name: Publish release F-Droid artifacts to Firebase
        if: ${{ github.ref_name == 'main' }}
        env:
          APP_FDROID_FIREBASE_CREDS_PATH: ${{ github.workspace }}/secrets/app_fdroid_firebase-creds.json
        run: |
          bundle exec fastlane distributeReleaseFDroidToFirebase \
          service_credentials_file:${{ env.APP_FDROID_FIREBASE_CREDS_PATH }}
-        shell: bash
@@ -1,17 +0,0 @@
---
-name: Enforce PR labels
-
-on:
-  workflow_call:
-  pull_request:
-    types: [labeled, unlabeled, opened, edited, synchronize]
-jobs:
-  enforce-label:
-    name: Enforce Label
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Enforce Label
-        uses: yogevbd/enforce-label-action@a3c219da6b8fa73f6ba62b68ff09c469b3a1c024 # 2.2.2
-        with:
-          BANNED_LABELS: "hold,needs-qa"
-          BANNED_LABELS_DESCRIPTION: "PRs with the hold or needs-qa labels cannot be merged"
@@ -0,0 +1,42 @@
+name: Scan
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - "main"
+      - "rc"
+      - "hotfix-rc"
+  pull_request_target:
+    types: [opened, synchronize]
+
+jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
+  sast:
+    name: SAST scan
+    runs-on: ubuntu-22.04
+    needs: check-run
+    permissions:
+      contents: read
+      pull-requests: write
+      security-events: write
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+        with:
+          ref: ${{  github.event.pull_request.head.sha }}
+
+      - name: Scan with Checkmarx
+        uses: checkmarx/ast-github-action@831a8d51a8a0535c0399f9c12728d8d3cc22d850 # 2.0.28
+        env:
+          INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}"
+        with:
+          project_name: ${{ github.repository }}
+          cx_tenant: ${{ secrets.CHECKMARX_TENANT }}
+          base_uri: https://ast.checkmarx.net/
+          cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
+          cx_client_secret: ${{ secrets.CHECKMARX_SECRET }}
@@ -1,30 +1,40 @@
---
-name: Run Check
+name: Test

 on:
-  pull_request:
+  push:
+    branches:
+      - "main"
+      - "rc"
+      - "hotfix-rc"
+  pull_request_target:
+    types: [opened, synchronize]

 env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  JAVA_VERSION: 17

 jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+
  test:
    name: Test
    runs-on: ubuntu-22.04
+    needs: check-run
+    permissions:
+      contents: read
+      pull-requests: write
+
    steps:
-      - name: Checkout
+      - name: Check out repo
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
-          fetch-depth: 0
-          # Allow subsequent steps to trigger GitHub Actions via git push
-          # https://github.community/t/push-from-action-even-with-pat-does-not-trigger-action/17622
-          persist-credentials: false
+          ref: ${{  github.event.pull_request.head.sha }}

-      - name: Validate Gradle Wrapper
+      - name: Validate Gradle wrapper
        uses: gradle/wrapper-validation-action@b5418f5a58f5fd2eb486dd7efb368fe7be7eae45 # v2.1.3

-      - name: Cache Gradle Files
+      - name: Cache Gradle files
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: |
@@ -43,10 +53,10 @@ jobs:
      - name: Configure JDK
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with:
-          distribution: 'temurin'
+          distribution: "temurin"
          java-version: ${{ env.JAVA_VERSION }}

-      - name: Build and Run Check
+      - name: Build and test
        # Run checks on standard variant only because release and beta builds are not configured to
        # work properly with the Compose testing library. F-Droid related tasks are also skipped as
        # there is no significant code difference between the builds.
@@ -1,11 +0,0 @@
---
-name: Workflow Linter
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/**
-
-jobs:
-  call-workflow:
-    uses: bitwarden/gh-actions/.github/workflows/workflow-linter.yml@main