Release 2.15.3

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 1
+    groups:
+      github-actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: "deps"
+      include: "scope"

.github/workflows/distribute-develop-mission.yml

@@ -8,10 +8,14 @@ on:
     types:
       - closed
 
+permissions:
+  contents: read
+
 jobs:
   call-reusable:
     if: ${{ github.event.pull_request.merged == true }}
     uses: ./.github/workflows/distribute-reusable.yml
     with:
       branch: ${{ github.base_ref }}
-    secrets: inherit
+    secrets:
+      GITLAB_TRIGGER_TOKEN: ${{ secrets.GITLAB_TRIGGER_TOKEN }}

.github/workflows/distribute-manual.yml

@@ -8,10 +8,14 @@ on:
         required: false
         default: ""
 
+permissions:
+  contents: read
+
 jobs:
   call-reusable:
     uses: ./.github/workflows/distribute-reusable.yml
     with:
       branch: ${{ github.ref_name }}   # SDK branch = current branch GitHub
       app_ref: ${{ inputs.app_ref }}   # optional override for GitLab ref
-    secrets: inherit
+    secrets:
+      GITLAB_TRIGGER_TOKEN: ${{ secrets.GITLAB_TRIGGER_TOKEN }}

.github/workflows/distribute-release-support-mission.yml

@@ -10,10 +10,14 @@ on:
       - opened
       - synchronize
 
+permissions:
+  contents: read
+
 jobs:
   call-reusable:
     if: ${{ startsWith(github.event.pull_request.head.ref, 'release/') }}
     uses: ./.github/workflows/distribute-reusable.yml
     with:
       branch: ${{ github.event.pull_request.head.ref }}
-    secrets: inherit
+    secrets:
+      GITLAB_TRIGGER_TOKEN: ${{ secrets.GITLAB_TRIGGER_TOKEN }}

.github/workflows/distribute-reusable.yml

@@ -14,12 +14,15 @@ on:
       GITLAB_TRIGGER_TOKEN:
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   trigger:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.branch }}
           fetch-depth: 3
@@ -29,9 +32,12 @@ jobs:
         run: |
           set -euo pipefail
           commits="$(git log -3 --pretty=format:"%s")"
-          echo "commits<<EOF" >> "$GITHUB_ENV"
-          echo "$commits"     >> "$GITHUB_ENV"
-          echo "EOF"          >> "$GITHUB_ENV"
+          delim="EOF_$(openssl rand -hex 8)"
+          {
+            echo "commits<<$delim"
+            echo "$commits"
+            echo "$delim"
+          } >> "$GITHUB_ENV"
 
       - name: Debug payload that will be sent to GitLab
         shell: bash

.github/workflows/gitleaks-secrets-validate.yml

@@ -2,18 +2,22 @@ name: Gitleaks Secrets Validate
 on:
   pull_request:
   workflow_dispatch:
+
+permissions:
+  contents: read
+
 jobs:
   scan:
     name: gitleaks
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
 
-    - name: Run Gitleaks
-      uses: gitleaks/gitleaks-action@v2
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        GITLEAKS_LICENSE: ${{ secrets.MINDBOX_GITLEAKS_LICENSE }}
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.MINDBOX_GITLEAKS_LICENSE }}

.github/workflows/lint_and_test.yml

@@ -11,18 +11,20 @@ on:
       - reopened
       - synchronize
 
+permissions:
+  contents: read
+
 jobs:
   unit-tests:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Setup node JS
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: 20
-        registry-url: https://registry.npmjs.org
+        node-version: 24
 
     - name: Setup local environment
       run: yarn
@@ -34,13 +36,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Setup node JS
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: 20
-        registry-url: https://registry.npmjs.org
+        node-version: 24
 
     - name: Setup local environment
       run: yarn

.github/workflows/manual-prepare_release_branch.yml

@@ -23,32 +23,38 @@ on:
         required: true
         default: 'master'
 
+permissions:
+  contents: read
+
 jobs:
   validate-input:
     name: Validate versions format
     runs-on: ubuntu-latest
     steps:
       - name: Check release_version
+        env:
+          V: ${{ github.event.inputs.release_version }}
         run: |
-          V=${{ github.event.inputs.release_version }}
           echo "Input release_version=$V"
           if ! [[ "$V" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-rc)?$ ]]; then
             echo "❌ release_version must be X.Y.Z or X.Y.Z-rc"
             exit 1
           fi
       - name: Check android_sdk_version if set
         if: ${{ github.event.inputs.android_sdk_version != '' }}
+        env:
+          A: ${{ github.event.inputs.android_sdk_version }}
         run: |
-          A=${{ github.event.inputs.android_sdk_version }}
           echo "Input android_sdk_version=$A"
           if ! [[ "$A" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-rc)?$ ]]; then
             echo "❌ android_sdk_version must be X.Y.Z or X.Y.Z-rc"
             exit 1
           fi
       - name: Check ios_sdk_version if set
         if: ${{ github.event.inputs.ios_sdk_version != '' }}
+        env:
+          I: ${{ github.event.inputs.ios_sdk_version }}
         run: |
-          I=${{ github.event.inputs.ios_sdk_version }}
           echo "Input ios_sdk_version=$I"
           if ! [[ "$I" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-rc)?$ ]]; then
             echo "❌ ios_sdk_version must be X.Y.Z or X.Y.Z-rc"
@@ -60,19 +66,21 @@ jobs:
     runs-on: ubuntu-latest
     needs: validate-input
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: { fetch-depth: 0 }
       - name: Check source branch
+        env:
+          SRC: ${{ github.event.inputs.source_branch }}
         run: |
-          SRC=${{ github.event.inputs.source_branch }}
-          if ! git ls-remote --heads origin "$SRC" | grep -q "$SRC"; then
+          if [ -z "$(git ls-remote --heads origin "refs/heads/$SRC")" ]; then
             echo "❌ source_branch '$SRC' does not exist on origin"
             exit 1
           fi
       - name: Check target branch
+        env:
+          DST: ${{ github.event.inputs.target_branch }}
         run: |
-          DST=${{ github.event.inputs.target_branch }}
-          if ! git ls-remote --heads origin "$DST" | grep -q "$DST"; then
+          if [ -z "$(git ls-remote --heads origin "refs/heads/$DST")" ]; then
             echo "❌ target_branch '$DST' does not exist on origin"
             exit 1
           fi
@@ -81,10 +89,12 @@ jobs:
     name: Create release branch & bump versions
     runs-on: ubuntu-latest
     needs: validate-branches
+    permissions:
+      contents: write
     outputs:
       release_branch: ${{ steps.bump.outputs.release_branch }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.inputs.source_branch }}
           fetch-depth: 0
@@ -96,12 +106,13 @@ jobs:
 
       - id: bump
         name: Create branch & apply bumps
+        env:
+          VERSION: ${{ github.event.inputs.release_version }}
+          AND_VER: ${{ github.event.inputs.android_sdk_version }}
+          IO_VER: ${{ github.event.inputs.ios_sdk_version }}
+          SRC: ${{ github.event.inputs.source_branch }}
         run: |
           set -euo pipefail
-          VERSION="${{ github.event.inputs.release_version }}"
-          AND_VER="${{ github.event.inputs.android_sdk_version }}"
-          IO_VER="${{ github.event.inputs.ios_sdk_version }}"
-          SRC="${{ github.event.inputs.source_branch }}"
           REL="release/$VERSION"
 
           # fallback to RN version
@@ -157,10 +168,12 @@ jobs:
           # 5) Final commit
           ##############################################################################
           git commit -m "Bump RN SDK versions: core=$VERSION, android=$AND_VER, ios=$IO_VER"
-          echo "release_branch=$REL" >> $GITHUB_OUTPUT
+          echo "release_branch=$REL" >> "$GITHUB_OUTPUT"
 
       - name: Push release branch
-        run: git push --set-upstream origin ${{ steps.bump.outputs.release_branch }}
+        env:
+          REL: ${{ steps.bump.outputs.release_branch }}
+        run: git push --set-upstream origin "$REL"
 
   create_pull_request:
     name: Create Pull Request
@@ -173,20 +186,22 @@ jobs:
           SRC: ${{ needs.bump_and_branch.outputs.release_branch }}
           DST: ${{ github.event.inputs.target_branch }}
           REPO: ${{ github.repository }}
+          RELEASE_VERSION: ${{ github.event.inputs.release_version }}
+          AND_VER: ${{ github.event.inputs.android_sdk_version }}
+          IO_VER: ${{ github.event.inputs.ios_sdk_version }}
         run: |
-          AND_VER=${{ github.event.inputs.android_sdk_version }}
-          IO_VER=${{ github.event.inputs.ios_sdk_version }}
-          [ -z "$AND_VER" ] && AND_VER="${{ github.event.inputs.release_version }}"
-          [ -z "$IO_VER"  ] && IO_VER="${{ github.event.inputs.release_version }}"
+          [ -z "$AND_VER" ] && AND_VER="$RELEASE_VERSION"
+          [ -z "$IO_VER"  ] && IO_VER="$RELEASE_VERSION"
 
+          # shellcheck disable=SC2016  # printf format string uses %s placeholders; literal backticks are intentional Markdown
           BODY=$(
             printf 'Automated PR: merge `%s` into `%s`\n\n**Versions:**\n- React Native SDK: `%s`\n- Android SDK: `%s`\n- iOS SDK: `%s`' \
-              "$SRC" "$DST" "${{ github.event.inputs.release_version }}" "$AND_VER" "$IO_VER"
+              "$SRC" "$DST" "$RELEASE_VERSION" "$AND_VER" "$IO_VER"
           )
 
           gh pr create \
             --repo "$REPO" \
             --base "$DST" \
             --head "$SRC" \
-            --title "Release ${{ github.event.inputs.release_version }}" \
+            --title "Release $RELEASE_VERSION" \
             --body "$BODY"

.github/workflows/pr-description-validate.yml

@@ -3,20 +3,24 @@ name: Validate PR description is not empty
 on:
   pull_request:
     types: [ opened, edited, reopened, synchronize ]
-  issue_comment:
-    types: [ created ]
+
+permissions:
+  contents: read
 
 jobs:
   check-description:
     runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'pull_request' || github.event.issue.pull_request }}
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
     steps:
     - name: Check out the repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Check PR description
       id: validate_description_step
-      uses: actions/github-script@v7
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         script: |
@@ -28,15 +32,15 @@ jobs:
             core.setOutput('pr_description_check_passed', 'true');
           }
     - name: Find Comment
-      uses: peter-evans/find-comment@v3
+      uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
       id: fc
       with:
         issue-number: ${{ github.event.pull_request.number }}
         comment-author: 'github-actions[bot]'
 
     - name: Update comment with validation failed statement
       if: ${{ steps.validate_description_step.outputs.pr_description_check_passed == 'false' }}
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
       with:
         issue-number: ${{ github.event.pull_request.number }}
         comment-id: ${{ steps.fc.outputs.comment-id }}