Set explicit runner version and specify build tools version for signing (mihonapp/mihon#1787)

(cherry picked from commit 7b70b40d300f3412b6dae8970817c01887050a24)

.github/workflows/build_benchmark.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   prepare-build:
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
     outputs:
       VERSION_TAG: ${{ steps.get_tag.outputs.VERSION_TAG }}
       ARTIFACTS_PREFIX: benchmark/app
@@ -57,7 +57,7 @@ jobs:
           echo "TAG_NAME=$tag_name" >> $GITHUB_OUTPUT
 
   build-app:
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
     needs: prepare-build
     if: startsWith(github.ref, 'refs/tags') && github.repository == 'komikku-app/komikku'
     steps:
@@ -89,13 +89,15 @@ jobs:
         run: ./gradlew testReleaseUnitTest
 
       - name: Sign APK
-        uses: r0adkll/sign-android-release@349ebdef58775b1e0d8099458af0816dc79b6407 # v1
+        uses: r0adkll/sign-android-release@f30bdd30588842ac76044ecdbd4b6d0e3e813478
         with:
           releaseDirectory: app/build/outputs/apk/benchmark
           signingKeyBase64: ${{ secrets.SIGNING_KEY }}
           alias: ${{ secrets.ALIAS }}
           keyStorePassword: ${{ secrets.KEY_STORE_PASSWORD }}
           keyPassword: ${{ secrets.KEY_PASSWORD }}
+        env:
+          BUILD_TOOLS_VERSION: '35.0.1'
 
       - name: Get SHA & clean up build artifacts
         id: get_sha

.github/workflows/build_dispatch_preview.yml

@@ -23,7 +23,7 @@ concurrency:
 jobs:
   trigger_preview_build:
     name: Trigger preview build
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
 
     steps:
       - name: Clone repo

.github/workflows/build_preview.yml

@@ -21,7 +21,7 @@ concurrency:
 
 jobs:
   prepare-build:
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
     outputs:
       VERSION_TAG: ${{ steps.get_tag.outputs.VERSION_TAG }}
       CURRENT_SHA: ${{ steps.current_commit.outputs.CURRENT_SHA }}
@@ -112,7 +112,7 @@ jobs:
           {delimiter}" >> $GITHUB_OUTPUT
 
   build-app:
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
     needs: prepare-build
     if: github.ref == 'refs/heads/master' && github.repository == 'komikku-app/komikku'
     steps:
@@ -164,7 +164,7 @@ jobs:
           retention-days: 1
 
   release-app:
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
     needs:
       - prepare-build
       - build-app
@@ -179,13 +179,15 @@ jobs:
           ${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager "build-tools;29.0.3"
 
       - name: Sign APK
-        uses: r0adkll/sign-android-release@349ebdef58775b1e0d8099458af0816dc79b6407 # v1
+        uses: r0adkll/sign-android-release@f30bdd30588842ac76044ecdbd4b6d0e3e813478
         with:
           releaseDirectory: app/build/outputs/apk/preview
           signingKeyBase64: ${{ secrets.SIGNING_KEY }}
           alias: ${{ secrets.ALIAS }}
           keyStorePassword: ${{ secrets.KEY_STORE_PASSWORD }}
           keyPassword: ${{ secrets.KEY_PASSWORD }}
+        env:
+          BUILD_TOOLS_VERSION: '35.0.1'
 
       - name: Get SHA & clean up build artifacts
         id: get_sha

.github/workflows/build_pull_request.yml

@@ -29,7 +29,7 @@ permissions:
 jobs:
   build:
     name: Build app
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
 
     steps:
       - name: Clone repo
@@ -77,13 +77,15 @@ jobs:
         run: ./gradlew testReleaseUnitTest
 
       - name: Sign APK
-        uses: r0adkll/sign-android-release@349ebdef58775b1e0d8099458af0816dc79b6407 # v1
+        uses: r0adkll/sign-android-release@f30bdd30588842ac76044ecdbd4b6d0e3e813478
         with:
           releaseDirectory: app/build/outputs/apk/release
           signingKeyBase64: ${{ secrets.SIGNING_KEY }}
           alias: ${{ secrets.ALIAS }}
           keyStorePassword: ${{ secrets.KEY_STORE_PASSWORD }}
           keyPassword: ${{ secrets.KEY_PASSWORD }}
+        env:
+          BUILD_TOOLS_VERSION: '35.0.1'
 
       - name: Rename apk
         id: current_commit

.github/workflows/build_push.yml

@@ -30,7 +30,7 @@ permissions:
 jobs:
   build:
     name: Build app
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
 
     steps:
       - name: Clone repo
@@ -75,13 +75,15 @@ jobs:
         run: ./gradlew testReleaseUnitTest
 
       - name: Sign APK
-        uses: r0adkll/sign-android-release@349ebdef58775b1e0d8099458af0816dc79b6407 # v1
+        uses: r0adkll/sign-android-release@f30bdd30588842ac76044ecdbd4b6d0e3e813478
         with:
           releaseDirectory: app/build/outputs/apk/release
           signingKeyBase64: ${{ secrets.SIGNING_KEY }}
           alias: ${{ secrets.ALIAS }}
           keyStorePassword: ${{ secrets.KEY_STORE_PASSWORD }}
           keyPassword: ${{ secrets.KEY_PASSWORD }}
+        env:
+          BUILD_TOOLS_VERSION: '35.0.1'
 
       - name: Rename apk
         id: current_commit

.github/workflows/build_release.yml

@@ -12,7 +12,7 @@ concurrency:
 
 jobs:
   prepare-build:
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
     outputs:
       VERSION_TAG: ${{ steps.get_tag.outputs.VERSION_TAG }}
       CURRENT_SHA: ${{ steps.current_commit.outputs.CURRENT_SHA }}
@@ -85,7 +85,7 @@ jobs:
 
   build-app:
     name: Build release app
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
     needs: prepare-build
     if: startsWith(github.ref, 'refs/tags/v') && github.repository == 'komikku-app/komikku'
     steps:
@@ -143,7 +143,7 @@ jobs:
           path: app/build/outputs/mapping/release
 
   release-app:
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
     needs:
       - prepare-build
       - build-app
@@ -158,13 +158,15 @@ jobs:
           ${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager "build-tools;29.0.3"
 
       - name: Sign APK
-        uses: r0adkll/sign-android-release@349ebdef58775b1e0d8099458af0816dc79b6407 # v1
+        uses: r0adkll/sign-android-release@f30bdd30588842ac76044ecdbd4b6d0e3e813478
         with:
           releaseDirectory: app/build/outputs/apk/release
           signingKeyBase64: ${{ secrets.SIGNING_KEY }}
           alias: ${{ secrets.ALIAS }}
           keyStorePassword: ${{ secrets.KEY_STORE_PASSWORD }}
           keyPassword: ${{ secrets.KEY_PASSWORD }}
+        env:
+          BUILD_TOOLS_VERSION: '35.0.1'
 
       - name: Get SHA & clean up build artifacts
         id: get_sha

.github/workflows/codeberg_mirror.yml

@@ -11,7 +11,7 @@ on:
 jobs:
   codeberg:
     if: github.repository == 'komikku-app/komikku'
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:

.github/workflows/delete_merged_branch.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   delete_merged_branch:
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
     if: github.event.pull_request.merged == true && github.repository == github.event.pull_request.head.repo.full_name
     steps:
       - name: Checkout repository

.github/workflows/issue_moderator.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   moderate:
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
     steps:
       - name: Moderate issues
         uses: tachiyomiorg/issue-moderator-action@32a31ab12ad6e68ebf4c65408f47bef132d4fd3c # v2.6.1

.github/workflows/pr_label.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   label_pr:
-    runs-on: ubuntu-latest
+    runs-on: 'ubuntu-24.04'
 
     steps:
       - name: Check PR and Add Label
@@ -14,7 +14,7 @@ jobs:
         with:
           script: |
             const prAuthor = context.payload.pull_request.user.login;
-            
+
             if (prAuthor === 'weblate') {
               const labels = ['Translations'];
               await github.issues.addLabels({