Korjaa Dependabot-päivitysten CI-tarkistukset

.github/dependabot.yml

@@ -8,6 +8,10 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action/*"
   - package-ecosystem: "npm"
     directory: "/.deepsec"
     schedule:

.github/workflows/codeql.yml

@@ -18,13 +18,19 @@
     name: Analyze (Java/Kotlin)
     runs-on: ubuntu-latest
     timeout-minutes: 360
+    env:
+      CODEQL_BUNDLE_PATH: ${{ runner.temp }}/codeql-bundle-20260724-linux64.tar.zst
+      CODEQL_BUNDLE_SHA256: 5bbf89fc9e818dbb45502c6697fe5806a17b868fba802f6e27e91110f84036b5
+      CODEQL_BUNDLE_URL: https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20260724/codeql-bundle-linux64.tar.zst
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1.
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0.
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.6.0.
         with:
           java-version: '21'
           distribution: 'temurin'
@@ -34,16 +40,24 @@
         with:
           packages: platform-tools platforms;android-37.0
 
+      - name: Download verified CodeQL bundle
+        shell: bash
+        run: |
+          curl --fail --location --retry 3 --output "$CODEQL_BUNDLE_PATH" "$CODEQL_BUNDLE_URL"
+          echo "$CODEQL_BUNDLE_SHA256  $CODEQL_BUNDLE_PATH" | sha256sum --check --strict
+
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # Lukittu versioon v4.37.0.
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.3.
         with:
           languages: java-kotlin
           build-mode: manual
+          # CodeQL 2.26.1 ei tue Kotlin 2.4.10:tä. Poista pin, kun vakaa bundle sisältää tuen.
+          tools: ${{ env.CODEQL_BUNDLE_PATH }}
 
       - name: Build with Gradle
         run: ./gradlew assembleDebug --no-daemon
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # Lukittu versioon v4.37.0.
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.3.
         with:
           category: "/language:java-kotlin"

.github/workflows/lint.yml

@@ -17,10 +17,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1.
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0.
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.6.0.
         with:
           java-version: '21'
           distribution: 'temurin'

.github/workflows/qodana.yml

@@ -16,10 +16,11 @@ jobs:
     name: Qodana Analysis (non-blocking AGP 9.3 risk)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1.
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Qodana Scan
         uses: JetBrains/qodana-action@4861e015da555e86a72b862892aba6c2b93e6891 # Lukittu versioon v2026.1.3.

.github/workflows/release-build.yml

@@ -17,10 +17,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1.
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0.
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.6.0.
         with:
           java-version: '21'
           distribution: temurin

.github/workflows/security.yml

@@ -21,7 +21,9 @@ jobs:
     container:
       image: semgrep/semgrep:1.162.0@sha256:9349edbadf90c3f3c0c3f55867625354e89680e6fa10d9034042af52fdb0e0d0
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1.
+        with:
+          persist-credentials: false
       - run: >
           semgrep scan
           --error
@@ -35,7 +37,7 @@ jobs:
           --sarif
           --output semgrep.sarif
           .
-      - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.0.
+      - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.3.
         if: always() && hashFiles('semgrep.sarif') != ''
         with:
           sarif_file: semgrep.sarif

.github/workflows/sonar.yml

@@ -16,12 +16,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1.
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0.
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.6.0.
         with:
           java-version: '21'
           distribution: 'temurin'