diff --git a/.github/workflows/block-dart-skills-prs.yaml b/.github/workflows/block-dart-skills-prs.yaml index 018547ef..32aadf1f 100644 --- a/.github/workflows/block-dart-skills-prs.yaml +++ b/.github/workflows/block-dart-skills-prs.yaml @@ -1,6 +1,12 @@ name: Block Upstream Skill Modifications +permissions: + contents: read + pull-requests: write + +# zizmor: ignore[dangerous-triggers] - {Needed to detect when Dart skills are modified} on: + # zizmor: ignore[dangerous-triggers] - {Needed to detect when Dart skills are modified} pull_request_target: types: [opened, synchronize, reopened] paths: @@ -18,7 +24,7 @@ jobs: github.event.pull_request.head.ref != 'automation/sync-dart-skills' steps: - name: Fail Action and Comment on PR - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const prNumber = context.payload.pull_request.number; diff --git a/.github/workflows/dart_skills_lint_release.yaml b/.github/workflows/dart_skills_lint_release.yaml index eca67799..f97c2ff1 100644 --- a/.github/workflows/dart_skills_lint_release.yaml +++ b/.github/workflows/dart_skills_lint_release.yaml @@ -1,5 +1,6 @@ name: dart_skills_lint release -permissions: read-all +permissions: + contents: read on: push: @@ -26,9 +27,11 @@ jobs: working-directory: tool/dart_skills_lint shell: bash steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - uses: dart-lang/setup-dart@v1 + - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 with: sdk: stable @@ -61,7 +64,7 @@ jobs: TARGET: ${{ matrix.target }} - name: Upload binary artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dart_skills_lint-${{ matrix.target }} path: | @@ -79,10 +82,12 @@ jobs: run: shell: bash steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Download all binary artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: path: dist merge-multiple: true @@ -142,20 +147,22 @@ jobs: VERSION: ${{ steps.meta.outputs.version }} - name: Create GitHub Release - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | set -euo pipefail PRERELEASE_FLAG="" - if [ "${{ steps.meta.outputs.prerelease }}" = "true" ]; then + if [ "${STEPS_META_OUTPUTS_PRERELEASE}" = "true" ]; then PRERELEASE_FLAG="--prerelease" fi - gh release create "${{ github.ref_name }}" \ - --title "dart_skills_lint v${{ steps.meta.outputs.version }}" \ + gh release create "${GITHUB_REF_NAME}" \ + --title "dart_skills_lint v${STEPS_META_OUTPUTS_VERSION}" \ --notes-file release-notes.md \ $PRERELEASE_FLAG \ dist/*.tar.gz \ dist/SHA256SUMS \ tool/dart_skills_lint/scripts/install.sh + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + STEPS_META_OUTPUTS_PRERELEASE: ${{ steps.meta.outputs.prerelease }} + STEPS_META_OUTPUTS_VERSION: ${{ steps.meta.outputs.version }} diff --git a/.github/workflows/dart_skills_lint_workflow.yaml b/.github/workflows/dart_skills_lint_workflow.yaml index 3e0ba724..2999f802 100644 --- a/.github/workflows/dart_skills_lint_workflow.yaml +++ b/.github/workflows/dart_skills_lint_workflow.yaml @@ -1,5 +1,6 @@ name: dart_skills_lint -permissions: read-all +permissions: + contents: read on: pull_request: @@ -28,8 +29,10 @@ jobs: os: [ubuntu-latest, macos-latest, windows-latest] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v7 - - uses: dart-lang/setup-dart@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 with: sdk: stable @@ -51,35 +54,19 @@ jobs: dart run bin/main.dart coverage: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - - uses: dart-lang/setup-dart@v1 - with: - sdk: stable - - - run: dart pub get - - - name: Collect coverage - run: dart test --coverage=coverage - - - name: Format coverage to LCOV - run: dart run coverage:format_coverage --lcov --in=coverage --out=coverage/lcov.info --report-on=lib - - # Action steps do not inherit defaults.run.working-directory, so this - # path is relative to the repository root. - - name: Enforce coverage threshold - uses: VeryGoodOpenSource/very_good_coverage@c953fca3e24a915e111cc6f55f03f756dcb3964c # v3 - with: - path: tool/dart_skills_lint/coverage/lcov.info - min_coverage: 73 - exclude: '**/*.g.dart' + uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/dart_package.yml@86e2d68bb1e27b2518e4a2277205d23d21cb413c # v1 + with: + working_directory: tool/dart_skills_lint + min_coverage: 73 + exclude: '**/*.g.dart' formatting: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: dart-lang/setup-dart@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 with: sdk: stable @@ -90,8 +77,10 @@ jobs: pana_score: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: dart-lang/setup-dart@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 with: sdk: stable diff --git a/.github/workflows/skills_tool.yaml b/.github/workflows/skills_tool.yaml index ba0c45b7..182fa306 100644 --- a/.github/workflows/skills_tool.yaml +++ b/.github/workflows/skills_tool.yaml @@ -1,5 +1,6 @@ name: skills_tool -permissions: read-all +permissions: + contents: read on: # Run CI on all PRs (against any branch) and on pushes to the main branch. @@ -27,8 +28,10 @@ jobs: os: [ubuntu-latest, macos-latest, windows-latest] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v7 - - uses: dart-lang/setup-dart@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 with: sdk: stable @@ -41,8 +44,10 @@ jobs: formatting_stable_ubuntu-latest: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: dart-lang/setup-dart@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 with: sdk: stable diff --git a/.github/workflows/sync_skills.yaml b/.github/workflows/sync_skills.yaml index 4784ff55..58a6f9d1 100644 --- a/.github/workflows/sync_skills.yaml +++ b/.github/workflows/sync_skills.yaml @@ -1,74 +1,65 @@ -name: Sync Skills Directory via Git Hash (Dart) +name: Sync Skills Directory + +permissions: + contents: write + pull-requests: write on: schedule: - - cron: '0 0 * * *' # Keep the daily check as a fallback safety net - workflow_dispatch: # Keep manual run capability - repository_dispatch: - types: [dart-skills-updated] # Listen for this custom ping + - cron: '0 0 * * *' # Runs daily at midnight UTC + workflow_dispatch: # Allows manual triggering + jobs: sync: runs-on: ubuntu-latest - permissions: - contents: write - pull-requests: write steps: + # 1. Checkout Flutter Skills (Destination) - name: Checkout Flutter Skills (Destination) - uses: actions/checkout@v7 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 (Pinned to hash) with: - # Falls back to the default GITHUB_TOKEN if SYNC_PAT is not defined - token: ${{ secrets.SYNC_PAT || github.token }} + token: ${{ secrets.SYNC_PAT || github.token }} # Falls back to default if SYNC_PAT is undefined + persist-credentials: false path: dest_repo + # 2. Checkout Dart Skills (Source) - name: Checkout Dart Skills (Source) - uses: actions/checkout@v7 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 (Pinned to hash) with: repository: dart-lang/skills fetch-depth: 50 + persist-credentials: false path: src_repo + # 3. Setup Dart Environment - name: Setup Dart Environment - uses: dart-lang/setup-dart@v1 + uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 with: sdk: stable + # 4. Sync files and copy - name: Execute Dart Sync Engine id: sync_engine run: | cd dest_repo - # Run our compiled-on-the-fly Dart script - EXIT_CODE=0 - dart run tool/sync_skills.dart ../src_repo skills || EXIT_CODE=$? - - if [ $EXIT_CODE -eq 0 ]; then - echo "changes_detected=true" >> $GITHUB_OUTPUT - elif [ $EXIT_CODE -eq 10 ]; then - echo "changes_detected=false" >> $GITHUB_OUTPUT - echo "✅ Dart script signaled NO changes were found. Stopping workflow." - else - echo "❌ Dart script failed with error code $EXIT_CODE" - exit $EXIT_CODE - fi + dart run tool/sync_skills.dart ../src_repo skills + + # 5. Configure Git Credentials under allowlisted Robot Bot + - name: Configure Git Credentials + run: | + git config --global user.name "flutter-skills-sync-bot" + git config --global user.email "flutter-agent-sync-bot@google.com" + env: + GH_TOKEN: ${{ secrets.SYNC_PAT || github.token }} + # 6. Create Pull Request using custom PAT credentials - name: Create Pull Request if: steps.sync_engine.outputs.changes_detected == 'true' - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 (Pinned to official hash) with: token: ${{ secrets.SYNC_PAT || github.token }} path: dest_repo branch: automation/sync-dart-skills title: "🤖 chore: sync skills directory from dart-lang/skills" commit-message: "chore: auto-sync skills directory from dart-lang/skills" - body: | - ### 🤖 Automated Skills Sync & Version Bump (Dart Powered) - This is an automated pull request to sync the contents of the `skills/` directory from [dart-lang/skills](https://github.com/dart-lang/skills). - - This run used a state-tracked Git hash (`.dart_skills_githash`) computed directly by our custom **Dart synchronization utility** (`tool/sync_skills.dart`). - - ### 🛠️ Changes Performed: - * **Preserved:** All native `flutter/*` skills in the repository remain unchanged. - * **Synced:** All new, modified, or deleted files inside `dart-lang/skills` have been carried over. - * **Bumped:** Automatically incremented the plugin version field in `.claude-plugin/plugin.json` to keep integrations updated. - labels: | - automated-pr - sync + committer: flutter-skills-sync-bot + author: flutter-skills-sync-bot diff --git a/tool/dart_skills_lint/pubspec.yaml b/tool/dart_skills_lint/pubspec.yaml index 58003842..aa5d0076 100644 --- a/tool/dart_skills_lint/pubspec.yaml +++ b/tool/dart_skills_lint/pubspec.yaml @@ -4,6 +4,7 @@ description: >- Validates frontmatter, naming, paths, and structure for use in CI and pre-commit hooks. version: 0.5.0 +resolution: workspace repository: https://github.com/flutter/agent-plugins issue_tracker: https://github.com/flutter/agent-plugins/issues