Add manifest-shield

.github/workflows/build.yaml

@@ -31,6 +31,9 @@ jobs:
       - name: Check dependencyGuard
         run: ./gradlew dependencyGuard
 
+      - name: Check manifestShield
+        run: ./gradlew manifestShield
+
       - name: Check spotless
         run: ./gradlew spotlessCheck --init-script gradle/init.gradle.kts --stacktrace
 

CHECK.md

@@ -13,6 +13,11 @@
 ./gradlew dependencyGuard
 ```
 
+- manifestShield
+```bash
+./gradlew manifestShield
+```
+
 - spotless
 ```bash
 ./gradlew spotlessCheck --init-script gradle/init.gradle.kts
@@ -30,6 +35,11 @@
 ./gradlew dependencyGuardBaseline
 ```
 
+- manifestShield
+```bash
+./gradlew manifestShieldBaseline
+```
+
 - spotless
 ```bash
 ./gradlew spotlessApply --init-script gradle/init.gradle.kts

app/build.gradle

@@ -4,6 +4,7 @@ plugins {
     id "moop.android.hilt"
     id "org.jetbrains.kotlin.plugin.serialization"
     alias libs.plugins.dependencyGuard
+    alias libs.plugins.manifestShield
     alias(libs.plugins.baselineprofile)
 }
 
@@ -136,6 +137,10 @@ dependencyGuard {
     configuration("releaseRuntimeClasspath")
 }
 
+manifestShield {
+    configuration("release")
+}
+
 task applyDependencyBaseline {
     dependsOn "dependencyGuardBaseline"
 }

app/manifestShield/releaseAndroidManifest.txt

@@ -0,0 +1,11 @@
+uses-permission:
+  android.permission.ACCESS_NETWORK_STATE
+  android.permission.FOREGROUND_SERVICE
+  android.permission.INTERNET
+  android.permission.POST_NOTIFICATIONS
+  android.permission.RECEIVE_BOOT_COMPLETED
+  android.permission.WAKE_LOCK
+  soup.movie.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
+
+activity:
+  soup.movie.ui.main.MainActivity (exported)

build.gradle

@@ -7,6 +7,7 @@ plugins {
     alias(libs.plugins.dagger.hilt) apply false
     alias(libs.plugins.ksp) apply false
     alias(libs.plugins.dependencyGuard) apply false
+    alias(libs.plugins.manifestShield) apply false
     alias(libs.plugins.baselineprofile) apply false
 }
 

check.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 # Check script for PR submission
-# Validates dependencies, code formatting, lint.
+# Validates dependencies, merged manifest, code formatting, lint.
 
 # Exit immediately if any command fails
 set -e
@@ -9,19 +9,25 @@ echo "Starting check validations..."
 echo ""
 
 # Verify dependency changes
-echo "🔍 [1/3] Checking dependency guard..."
+echo "🔍 [1/4] Checking dependency guard..."
 ./gradlew dependencyGuard
 echo "✓ Dependency guard check passed"
 echo ""
 
+# Verify merged manifest changes
+echo "🔍 [2/4] Checking manifest shield..."
+./gradlew manifestShield
+echo "✓ Manifest shield check passed"
+echo ""
+
 # Verify code formatting
-echo "🔍 [2/3] Checking code formatting..."
+echo "🔍 [3/4] Checking code formatting..."
 ./gradlew spotlessCheck --init-script gradle/init.gradle.kts
 echo "✓ Code formatting check passed"
 echo ""
 
 # Static analysis and lint checks
-echo "🔍 [3/3] Running lint checks..."
+echo "🔍 [4/4] Running lint checks..."
 ./gradlew lintDebug
 echo "✓ Lint check passed"
 echo ""

gradle/libs.versions.toml

@@ -38,6 +38,7 @@ photo-compose = "1.0.1"
 # Etc
 coil = "3.3.0"
 dependencyGuard = "0.5.0"
+manifestShield = "0.1.10"
 retrofit = "3.0.0"
 timber = "5.0.1"
 
@@ -149,4 +150,5 @@ kotlin-serialization = { id = "org.jetbrains.kotlin.plugin.serialization", versi
 compose-compiler = { id = "org.jetbrains.kotlin.plugin.compose", version.ref = "kotlin" }
 ksp = { id = "com.google.devtools.ksp", version.ref = "ksp" }
 dependencyGuard = { id = "com.dropbox.dependency-guard", version.ref = "dependencyGuard" }
+manifestShield = { id = "io.github.fornewid.manifest-shield", version.ref = "manifestShield" }
 baselineprofile = { id = "androidx.baselineprofile", version.ref = "androidx-benchmark" }