[dependabot]

Bumps zizmorcore/zizmor-action from 0.6.4 to 0.7.1.

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

... (truncated)

Commits

• 85b2b9f Sync zizmor versions (#178)
• 38c745a README: bump pins (#177)
• f9597c8 Sync zizmor versions (#175)
• 2181e51 Bump sync-zizmor-versions.py to Python 3.11 for locking (#174)
• 27d989b chore(deps): bump the github-actions group with 2 updates (#173)
• a91218c Bootstrap zizmor without Docker (#169)
• ee3f1bf chore(deps): bump the github-actions group with 2 updates (#170)
• 8eacaa5 README: bump pins (#167)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Kotlin migration progress

No change to the Java left to convert.

Module	Kotlin LOC	Java LOC	Java staying (facade)	Java left to convert	Kotlin share
android-core	3,249	22,690	9,716	12,974	12.5%
android-kit-base	601	5,405	1,651	3,754	10.0%
Total	3,850	28,095	11,367	16,728	12.1%

Conversion progress: 0.0% (16,728 of 16,550 baseline Java LOC left to convert). 132 Java files and 36 Kotlin files in scope.

[github-actions]

Binary compatibility

• ✅ android-core is compatible with 6.1.9 (115 classes compared, 0 with additions only).
• ✅ android-kit-base is compatible with 6.1.9 (44 classes compared, 0 with additions only).

Compares the release AAR against the same artifact at the last version published to Maven Central; R8-renamed classes and members are excluded (see the script docstring). Full japicmp HTML/XML reports are attached as the api-compat-reports workflow artifact. This check is not in the required-check set yet, so a red result here does not block merging.

[github-actions]

📦 SDK Size Impact Report

What the SDK adds to a minified release APK.

mParticle Core SDK

Measured against an empty baseline app. Unlike the Rokt kit, android-core ships no Compose and no resources, so there is nothing here that a host app would already provide.

Metric	Target branch	This PR	Change
APK size	120.63 KB	120.63 KB	-4 bytes
Download size	118.45 KB	118.45 KB	-4 bytes
Dex bytes	215.25 KB	215.25 KB	0 bytes

mParticle Core + Rokt kit

Measured against a Compose + Material3 reference app, so these are the costs on top of an app that already ships Compose. The reference app's dependencies are a documented convention, not a measured average: see size-report-rokt/README.md.

Metric	Target branch	This PR	Change
APK size	1.26 MB	1.26 MB	0 bytes
Download size	1.25 MB	1.25 MB	-3 bytes
Dex bytes	2.23 MB	2.23 MB	0 bytes

Rokt SDK+ umbrella (adds the payment extension)

Metric	Target branch	This PR	Change	On top of mParticle Core + Rokt kit
APK size	6.55 MB	6.55 MB	0 bytes	+5.29 MB
Download size	6.43 MB	6.43 MB	+3 bytes	+5.19 MB
Dex bytes	7.12 MB	7.12 MB	0 bytes	+4.88 MB

➡️ SDK size impact change is minimal.

Raw measurements

core, Target branch:

{"baseline_dex_bytes": 0, "baseline_download_bytes": 2510, "baseline_install_bytes": 7527, "core_dex_bytes": 220412, "core_download_bytes": 123805, "core_install_bytes": 131055}

core, This PR:

{"baseline_dex_bytes": 0, "baseline_download_bytes": 2510, "baseline_install_bytes": 7527, "core_dex_bytes": 220412, "core_download_bytes": 123801, "core_install_bytes": 131051}

rokt, Target branch:

{"baseline_dex_bytes": 1829108, "baseline_download_bytes": 1240062, "baseline_install_bytes": 1300934, "kit_dex_bytes": 4170020, "kit_download_bytes": 2548125, "kit_install_bytes": 2623275, "sdkplus_dex_bytes": 9291568, "sdkplus_download_bytes": 7985699, "sdkplus_install_bytes": 8165359}

rokt, This PR:

{"baseline_dex_bytes": 1829108, "baseline_download_bytes": 1240062, "baseline_install_bytes": 1300934, "kit_dex_bytes": 4170020, "kit_download_bytes": 2548122, "kit_install_bytes": 2623275, "sdkplus_dex_bytes": 9291568, "sdkplus_download_bytes": 7985702, "sdkplus_install_bytes": 8165359}

_{Measured af9b0e9 merged into b7624a5}