From fcbe22a3855b30ef7b43c258980ce641f5e97fc6 Mon Sep 17 00:00:00 2001
From: MingWei Liao <mingweiliao@google.com>
Date: Thu, 29 Oct 2026 17:37:11 +0000
Subject: [PATCH] Add screenshot test validation to agent CI

- Add validateScreenshotTest step to .github/workflows/agent.yaml
- Pin GitHub Actions to commit SHAs and set explicit read permissions to satisfy zizmor security checks
---
 .github/workflows/agent.yaml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/agent.yaml b/.github/workflows/agent.yaml
index ebd2c966..175dbfeb 100644
--- a/.github/workflows/agent.yaml
+++ b/.github/workflows/agent.yaml
@@ -24,25 +24,27 @@ jobs:
     name: "Agent build & test"
     runs-on: macos-26
     timeout-minutes: 45
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: 'zulu'
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v4
+        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4
 
       - name: Run spotless
         run: ./gradlew spotlessCheck
@@ -52,12 +54,16 @@ jobs:
         run: ./gradlew test -PGEMINI_API_KEY=dummy_key
         working-directory: agent
 
+      - name: Run screenshot tests
+        run: ./gradlew validateScreenshotTest -PGEMINI_API_KEY=dummy_key
+        working-directory: agent
+
       - name: Build Debug and Release APKs
         run: ./gradlew assembleDebug assembleRelease -PGEMINI_API_KEY=dummy_key
         working-directory: agent
 
       - name: Upload Agent APKs
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: agent-apks
           path: agent/app/build/outputs/apk/**/*.apk