ci: remove dead inherited .github/workflows (pwn-request + cruft)
Some checks failed
gitleaks / scan (push) Failing after 3s

CI security audit finding. These are all inherited NewPipe GitHub workflows,
none functional on Forgejo — the real pipeline is .forgejo/workflows/.

Highest risk: pr-labeler.yml ran on pull_request_target with pull-requests:write
and called a mutable @main third-party action with GITHUB_TOKEN — a textbook
pwn-request on a public repo (base-repo write token, triggerable by any fork PR).
image-minimizer.yml ran arbitrary JS with issues/PR write perms. The rest
(no-response, backport-pr, ci, build-release-apk) are dead + were spamming a red
X on every push. Removing the lot drops third-party supply-chain surface to zero.

Also dropped changed-lines-count-labeler.yml (dead config for the deleted labeler).
This commit is contained in:
Cobb 2026-07-04 20:25:56 -07:00
parent e34fbd457b
commit 7ff1546d31
8 changed files with 0 additions and 470 deletions

View file

@ -1,38 +0,0 @@
name: "Build unsigned release APK on master"
on:
workflow_dispatch:
jobs:
release:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
with:
ref: 'master'
- uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '21'
cache: 'gradle'
- name: "Build release APK"
run: ./gradlew assembleRelease --stacktrace
- name: "Rename APK"
run: |
VERSION_NAME="$(jq -r ".elements[0].versionName" "app/build/outputs/apk/release/output-metadata.json")"
echo "Version name: $VERSION_NAME" >> "$GITHUB_STEP_SUMMARY"
echo '```json' >> "$GITHUB_STEP_SUMMARY"
cat "app/build/outputs/apk/release/output-metadata.json" >> "$GITHUB_STEP_SUMMARY"
echo >> "$GITHUB_STEP_SUMMARY"
echo '```' >> "$GITHUB_STEP_SUMMARY"
# assume there is only one APK in that folder
mv app/build/outputs/apk/release/*.apk "app/build/outputs/apk/release/NewPipe_v$VERSION_NAME.apk"
- name: "Upload APK"
uses: actions/upload-artifact@v7
with:
name: app
path: app/build/outputs/apk/release/*.apk