From 119d735204c943f01cd21955521ee01e4ccf9254 Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 12:44:10 -0700
Subject: [PATCH 01/13] Configure bot to sync skills

This configures the GitHub user to flutter-skills-sync-bot. The PAT for this account is stored as the SYNC_PAT secret in settings.

Fixes #197
---
 .github/workflows/sync_skills.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sync_skills.yaml b/.github/workflows/sync_skills.yaml
index 4784ff55..0dac6ea1 100644
--- a/.github/workflows/sync_skills.yaml
+++ b/.github/workflows/sync_skills.yaml
@@ -49,7 +49,10 @@ jobs:
             echo "❌ Dart script failed with error code $EXIT_CODE"
             exit $EXIT_CODE
           fi
-
+      - name: Configure Git Credentials
+        run: |
+          git config --global user.name "flutter-skills-sync-bot"
+          git config --global user.email "flutter-agent-sync-bot@google.com"
       - name: Create Pull Request
         if: steps.sync_engine.outputs.changes_detected == 'true'
         uses: peter-evans/create-pull-request@v8

From 185b954b369726b09e866d28061dd059d07e6799 Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 13:02:12 -0700
Subject: [PATCH 02/13] Pin GitHub actions to hash

---
 .github/workflows/sync_skills.yaml | 63 ++++++++++--------------------
 1 file changed, 20 insertions(+), 43 deletions(-)

diff --git a/.github/workflows/sync_skills.yaml b/.github/workflows/sync_skills.yaml
index 0dac6ea1..ef778f4d 100644
--- a/.github/workflows/sync_skills.yaml
+++ b/.github/workflows/sync_skills.yaml
@@ -1,77 +1,54 @@
-name: Sync Skills Directory via Git Hash (Dart)
+name: Sync Skills Directory
 
 on:
   schedule:
-    - cron: '0 0 * * *' # Keep the daily check as a fallback safety net
-  workflow_dispatch:   # Keep manual run capability
-  repository_dispatch:
-    types: [dart-skills-updated] # Listen for this custom ping
+    - cron: '0 0 * * *' # Runs daily at midnight UTC
+  workflow_dispatch: # Allows manual triggering
+
 jobs:
   sync:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
     steps:
+      # 1. Checkout Flutter Skills (Destination)
       - name: Checkout Flutter Skills (Destination)
-        uses: actions/checkout@v7
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 (Pinned to hash)
         with:
-          # Falls back to the default GITHUB_TOKEN if SYNC_PAT is not defined
-          token: ${{ secrets.SYNC_PAT || github.token }}
-          path: dest_repo
+          token: ${{ secrets.SYNC_PAT || github.token }} # Falls back to default if SYNC_PAT is undefined
 
+      # 2. Checkout Dart Skills (Source)
       - name: Checkout Dart Skills (Source)
-        uses: actions/checkout@v7
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 (Pinned to hash)
         with:
           repository: dart-lang/skills
           fetch-depth: 50
-          path: src_repo
 
+      # 3. Setup Dart Environment
       - name: Setup Dart Environment
-        uses: dart-lang/setup-dart@v1
+        uses: dart-lang/setup-dart@fed7495a1ee86c728744377be831139154784a0d # v1.6.5 (Pinned to hash)
         with:
           sdk: stable
 
+      # 4. Sync files and copy
       - name: Execute Dart Sync Engine
-        id: sync_engine
         run: |
           cd dest_repo
-          # Run our compiled-on-the-fly Dart script
-          EXIT_CODE=0
-          dart run tool/sync_skills.dart ../src_repo skills || EXIT_CODE=$?
-          
-          if [ $EXIT_CODE -eq 0 ]; then
-            echo "changes_detected=true" >> $GITHUB_OUTPUT
-          elif [ $EXIT_CODE -eq 10 ]; then
-            echo "changes_detected=false" >> $GITHUB_OUTPUT
-            echo "✅ Dart script signaled NO changes were found. Stopping workflow."
-          else
-            echo "❌ Dart script failed with error code $EXIT_CODE"
-            exit $EXIT_CODE
-          fi
+          dart run tool/sync_skills.dart ../src_repo skills
+
+      # 5. Configure Git Credentials under allowlisted Robot Bot
       - name: Configure Git Credentials
         run: |
           git config --global user.name "flutter-skills-sync-bot"
           git config --global user.email "flutter-agent-sync-bot@google.com"
+
+      # 6. Create Pull Request using custom PAT credentials
       - name: Create Pull Request
         if: steps.sync_engine.outputs.changes_detected == 'true'
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@dd475f2b711485001d511ea15a9630c144e59f42 # v7.0.1 (Pinned to hash)
         with:
           token: ${{ secrets.SYNC_PAT || github.token }}
           path: dest_repo
           branch: automation/sync-dart-skills
           title: "🤖 chore: sync skills directory from dart-lang/skills"
           commit-message: "chore: auto-sync skills directory from dart-lang/skills"
-          body: |
-            ### 🤖 Automated Skills Sync & Version Bump (Dart Powered)
-            This is an automated pull request to sync the contents of the `skills/` directory from [dart-lang/skills](https://github.com/dart-lang/skills).
-            
-            This run used a state-tracked Git hash (`.dart_skills_githash`) computed directly by our custom **Dart synchronization utility** (`tool/sync_skills.dart`).
-            
-            ### 🛠️ Changes Performed:
-            * **Preserved:** All native `flutter/*` skills in the repository remain unchanged.
-            * **Synced:** All new, modified, or deleted files inside `dart-lang/skills` have been carried over.
-            * **Bumped:** Automatically incremented the plugin version field in `.claude-plugin/plugin.json` to keep integrations updated.
-          labels: |
-            automated-pr
-            sync
+          committer: flutter-skills-sync-bot <flutter-agent-sync-bot@google.com>
+          author: flutter-skills-sync-bot <flutter-agent-sync-bot@google.com>

From 1b81a4f70e00a27eb8eab4cd1cb84aad007d4ae9 Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 13:18:09 -0700
Subject: [PATCH 03/13] Fix zizmor warnings

---
 .github/workflows/block-dart-skills-prs.yaml  |  2 +-
 .../workflows/dart_skills_lint_release.yaml   | 22 ++++++++++-------
 .../workflows/dart_skills_lint_workflow.yaml  | 24 ++++++++++++-------
 .github/workflows/skills_tool.yaml            | 12 ++++++----
 .github/workflows/sync_skills.yaml            |  6 +++--
 5 files changed, 43 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/block-dart-skills-prs.yaml b/.github/workflows/block-dart-skills-prs.yaml
index 018547ef..f6ab1b6a 100644
--- a/.github/workflows/block-dart-skills-prs.yaml
+++ b/.github/workflows/block-dart-skills-prs.yaml
@@ -18,7 +18,7 @@ jobs:
       github.event.pull_request.head.ref != 'automation/sync-dart-skills'
     steps:
       - name: Fail Action and Comment on PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const prNumber = context.payload.pull_request.number;
diff --git a/.github/workflows/dart_skills_lint_release.yaml b/.github/workflows/dart_skills_lint_release.yaml
index eca67799..d951e061 100644
--- a/.github/workflows/dart_skills_lint_release.yaml
+++ b/.github/workflows/dart_skills_lint_release.yaml
@@ -26,9 +26,11 @@ jobs:
         working-directory: tool/dart_skills_lint
         shell: bash
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - uses: dart-lang/setup-dart@v1
+      - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
         with:
           sdk: stable
 
@@ -61,7 +63,7 @@ jobs:
           TARGET: ${{ matrix.target }}
 
       - name: Upload binary artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dart_skills_lint-${{ matrix.target }}
           path: |
@@ -79,10 +81,12 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Download all binary artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: dist
           merge-multiple: true
@@ -144,16 +148,18 @@ jobs:
       - name: Create GitHub Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STEPS_META_OUTPUTS_PRERELEASE: ${{ steps.meta.outputs.prerelease }}
+          STEPS_META_OUTPUTS_VERSION: ${{ steps.meta.outputs.version }}
         run: |
           set -euo pipefail
           
           PRERELEASE_FLAG=""
-          if [ "${{ steps.meta.outputs.prerelease }}" = "true" ]; then
+          if [ "${STEPS_META_OUTPUTS_PRERELEASE}" = "true" ]; then
             PRERELEASE_FLAG="--prerelease"
           fi
           
-          gh release create "${{ github.ref_name }}" \
-            --title "dart_skills_lint v${{ steps.meta.outputs.version }}" \
+          gh release create "${GITHUB_REF_NAME}" \
+            --title "dart_skills_lint v${STEPS_META_OUTPUTS_VERSION}" \
             --notes-file release-notes.md \
             $PRERELEASE_FLAG \
             dist/*.tar.gz \
diff --git a/.github/workflows/dart_skills_lint_workflow.yaml b/.github/workflows/dart_skills_lint_workflow.yaml
index 3e0ba724..be8c4c16 100644
--- a/.github/workflows/dart_skills_lint_workflow.yaml
+++ b/.github/workflows/dart_skills_lint_workflow.yaml
@@ -28,8 +28,10 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: dart-lang/setup-dart@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
         with:
           sdk: stable
 
@@ -53,8 +55,10 @@ jobs:
   coverage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dart-lang/setup-dart@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
         with:
           sdk: stable
 
@@ -78,8 +82,10 @@ jobs:
   formatting:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dart-lang/setup-dart@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
         with:
           sdk: stable
 
@@ -90,8 +96,10 @@ jobs:
   pana_score:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dart-lang/setup-dart@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
         with:
           sdk: stable
 
diff --git a/.github/workflows/skills_tool.yaml b/.github/workflows/skills_tool.yaml
index ba0c45b7..f560d032 100644
--- a/.github/workflows/skills_tool.yaml
+++ b/.github/workflows/skills_tool.yaml
@@ -27,8 +27,10 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: dart-lang/setup-dart@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
         with:
           sdk: stable
 
@@ -41,8 +43,10 @@ jobs:
   formatting_stable_ubuntu-latest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dart-lang/setup-dart@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
         with:
           sdk: stable
 
diff --git a/.github/workflows/sync_skills.yaml b/.github/workflows/sync_skills.yaml
index ef778f4d..10a8bc9a 100644
--- a/.github/workflows/sync_skills.yaml
+++ b/.github/workflows/sync_skills.yaml
@@ -14,6 +14,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 (Pinned to hash)
         with:
           token: ${{ secrets.SYNC_PAT || github.token }} # Falls back to default if SYNC_PAT is undefined
+          persist-credentials: false
 
       # 2. Checkout Dart Skills (Source)
       - name: Checkout Dart Skills (Source)
@@ -21,10 +22,11 @@ jobs:
         with:
           repository: dart-lang/skills
           fetch-depth: 50
+          persist-credentials: false
 
       # 3. Setup Dart Environment
       - name: Setup Dart Environment
-        uses: dart-lang/setup-dart@fed7495a1ee86c728744377be831139154784a0d # v1.6.5 (Pinned to hash)
+        uses: dart-lang/setup-dart@b77f714ba35594641a83a71d243c7de39d820474 # v1.6.5 (Pinned to official hash)
         with:
           sdk: stable
 
@@ -43,7 +45,7 @@ jobs:
       # 6. Create Pull Request using custom PAT credentials
       - name: Create Pull Request
         if: steps.sync_engine.outputs.changes_detected == 'true'
-        uses: peter-evans/create-pull-request@dd475f2b711485001d511ea15a9630c144e59f42 # v7.0.1 (Pinned to hash)
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 (Pinned to official hash)
         with:
           token: ${{ secrets.SYNC_PAT || github.token }}
           path: dest_repo

From 80480c70a27ff4eb260899fc8c79a0edcfbb41d3 Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 13:23:35 -0700
Subject: [PATCH 04/13] add resolution:workspace to dart_skills_lint

---
 tool/dart_skills_lint/pubspec.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tool/dart_skills_lint/pubspec.yaml b/tool/dart_skills_lint/pubspec.yaml
index 58003842..aa5d0076 100644
--- a/tool/dart_skills_lint/pubspec.yaml
+++ b/tool/dart_skills_lint/pubspec.yaml
@@ -4,6 +4,7 @@ description: >-
   Validates frontmatter, naming, paths, and structure for use in CI and
   pre-commit hooks.
 version: 0.5.0
+resolution: workspace
 repository: https://github.com/flutter/agent-plugins
 issue_tracker: https://github.com/flutter/agent-plugins/issues
 

From b630da4120d2191076fcbf708fb6a966bbf502e6 Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 13:33:08 -0700
Subject: [PATCH 05/13] Fix / ignore zizmor warnings

---
 .github/workflows/block-dart-skills-prs.yaml     |  6 ++++++
 .github/workflows/dart_skills_lint_release.yaml  | 11 ++++++-----
 .github/workflows/dart_skills_lint_workflow.yaml |  4 +++-
 .github/workflows/skills_tool.yaml               |  3 ++-
 .github/workflows/sync_skills.yaml               |  9 +++++++++
 5 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/block-dart-skills-prs.yaml b/.github/workflows/block-dart-skills-prs.yaml
index f6ab1b6a..d48f1887 100644
--- a/.github/workflows/block-dart-skills-prs.yaml
+++ b/.github/workflows/block-dart-skills-prs.yaml
@@ -1,6 +1,12 @@
 name: Block Upstream Skill Modifications
 
+permissions:
+  contents: read
+  pull-requests: write
+
+# zizmor: ignore[dangerous-triggers]
 on:
+  # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types: [opened, synchronize, reopened]
     paths:
diff --git a/.github/workflows/dart_skills_lint_release.yaml b/.github/workflows/dart_skills_lint_release.yaml
index d951e061..f97c2ff1 100644
--- a/.github/workflows/dart_skills_lint_release.yaml
+++ b/.github/workflows/dart_skills_lint_release.yaml
@@ -1,5 +1,6 @@
 name: dart_skills_lint release
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   push:
@@ -146,10 +147,6 @@ jobs:
           VERSION: ${{ steps.meta.outputs.version }}
 
       - name: Create GitHub Release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          STEPS_META_OUTPUTS_PRERELEASE: ${{ steps.meta.outputs.prerelease }}
-          STEPS_META_OUTPUTS_VERSION: ${{ steps.meta.outputs.version }}
         run: |
           set -euo pipefail
           
@@ -165,3 +162,7 @@ jobs:
             dist/*.tar.gz \
             dist/SHA256SUMS \
             tool/dart_skills_lint/scripts/install.sh
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STEPS_META_OUTPUTS_PRERELEASE: ${{ steps.meta.outputs.prerelease }}
+          STEPS_META_OUTPUTS_VERSION: ${{ steps.meta.outputs.version }}
diff --git a/.github/workflows/dart_skills_lint_workflow.yaml b/.github/workflows/dart_skills_lint_workflow.yaml
index be8c4c16..6132b127 100644
--- a/.github/workflows/dart_skills_lint_workflow.yaml
+++ b/.github/workflows/dart_skills_lint_workflow.yaml
@@ -1,5 +1,6 @@
 name: dart_skills_lint
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request:
@@ -72,6 +73,7 @@ jobs:
 
       # Action steps do not inherit defaults.run.working-directory, so this
       # path is relative to the repository root.
+      # zizmor: ignore[archived-uses]
       - name: Enforce coverage threshold
         uses: VeryGoodOpenSource/very_good_coverage@c953fca3e24a915e111cc6f55f03f756dcb3964c # v3
         with:
diff --git a/.github/workflows/skills_tool.yaml b/.github/workflows/skills_tool.yaml
index f560d032..182fa306 100644
--- a/.github/workflows/skills_tool.yaml
+++ b/.github/workflows/skills_tool.yaml
@@ -1,5 +1,6 @@
 name: skills_tool
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   # Run CI on all PRs (against any branch) and on pushes to the main branch.
diff --git a/.github/workflows/sync_skills.yaml b/.github/workflows/sync_skills.yaml
index 10a8bc9a..a9c86924 100644
--- a/.github/workflows/sync_skills.yaml
+++ b/.github/workflows/sync_skills.yaml
@@ -1,5 +1,9 @@
 name: Sync Skills Directory
 
+permissions:
+  contents: write
+  pull-requests: write
+
 on:
   schedule:
     - cron: '0 0 * * *' # Runs daily at midnight UTC
@@ -15,6 +19,7 @@ jobs:
         with:
           token: ${{ secrets.SYNC_PAT || github.token }} # Falls back to default if SYNC_PAT is undefined
           persist-credentials: false
+          path: dest_repo
 
       # 2. Checkout Dart Skills (Source)
       - name: Checkout Dart Skills (Source)
@@ -23,6 +28,7 @@ jobs:
           repository: dart-lang/skills
           fetch-depth: 50
           persist-credentials: false
+          path: src_repo
 
       # 3. Setup Dart Environment
       - name: Setup Dart Environment
@@ -32,6 +38,7 @@ jobs:
 
       # 4. Sync files and copy
       - name: Execute Dart Sync Engine
+        id: sync_engine
         run: |
           cd dest_repo
           dart run tool/sync_skills.dart ../src_repo skills
@@ -41,6 +48,8 @@ jobs:
         run: |
           git config --global user.name "flutter-skills-sync-bot"
           git config --global user.email "flutter-agent-sync-bot@google.com"
+        env:
+          GH_TOKEN: ${{ secrets.SYNC_PAT || github.token }}
 
       # 6. Create Pull Request using custom PAT credentials
       - name: Create Pull Request

From 09973e9f3e3b93d7abda087f69c8a1eb9e0d14cf Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 13:34:09 -0700
Subject: [PATCH 06/13] use very_good_workflows to avoid zizmor warning

---
 .../workflows/dart_skills_lint_workflow.yaml  | 30 +++----------------
 1 file changed, 4 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/dart_skills_lint_workflow.yaml b/.github/workflows/dart_skills_lint_workflow.yaml
index 6132b127..14ad34e6 100644
--- a/.github/workflows/dart_skills_lint_workflow.yaml
+++ b/.github/workflows/dart_skills_lint_workflow.yaml
@@ -54,32 +54,10 @@ jobs:
           dart run bin/main.dart
 
   coverage:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
-        with:
-          sdk: stable
-
-      - run: dart pub get
-
-      - name: Collect coverage
-        run: dart test --coverage=coverage
-
-      - name: Format coverage to LCOV
-        run: dart run coverage:format_coverage --lcov --in=coverage --out=coverage/lcov.info --report-on=lib
-
-      # Action steps do not inherit defaults.run.working-directory, so this
-      # path is relative to the repository root.
-      # zizmor: ignore[archived-uses]
-      - name: Enforce coverage threshold
-        uses: VeryGoodOpenSource/very_good_coverage@c953fca3e24a915e111cc6f55f03f756dcb3964c # v3
-        with:
-          path: tool/dart_skills_lint/coverage/lcov.info
-          min_coverage: 73
-          exclude: '**/*.g.dart'
+    uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/dart_package.yml@v1
+    with:
+      working_directory: tool/dart_skills_lint
+      min_coverage: 73
 
   formatting:
     runs-on: ubuntu-latest

From 89a5f753cce7960d1e52c471564ff4c381c9b015 Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 13:37:31 -0700
Subject: [PATCH 07/13] Fix zizmor warning

---
 .github/workflows/dart_skills_lint_workflow.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dart_skills_lint_workflow.yaml b/.github/workflows/dart_skills_lint_workflow.yaml
index 14ad34e6..58e4619c 100644
--- a/.github/workflows/dart_skills_lint_workflow.yaml
+++ b/.github/workflows/dart_skills_lint_workflow.yaml
@@ -54,7 +54,7 @@ jobs:
           dart run bin/main.dart
 
   coverage:
-    uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/dart_package.yml@v1
+    uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/dart_package.yml@v1 # zizmor: ignore[unpinned-uses]
     with:
       working_directory: tool/dart_skills_lint
       min_coverage: 73

From f67e39d36ba134431c4e2794a1feb51de68d8f87 Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 13:40:03 -0700
Subject: [PATCH 08/13] update hash

---
 .github/workflows/sync_skills.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/sync_skills.yaml b/.github/workflows/sync_skills.yaml
index a9c86924..58a6f9d1 100644
--- a/.github/workflows/sync_skills.yaml
+++ b/.github/workflows/sync_skills.yaml
@@ -32,7 +32,7 @@ jobs:
 
       # 3. Setup Dart Environment
       - name: Setup Dart Environment
-        uses: dart-lang/setup-dart@b77f714ba35594641a83a71d243c7de39d820474 # v1.6.5 (Pinned to official hash)
+        uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
         with:
           sdk: stable
 

From f911d210b56776a6312894474b5b43de261fb85b Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 13:41:58 -0700
Subject: [PATCH 09/13] Fix zizmor unpinned-uses by pinning very_good_coverage
 to hash with inline ignore comment

---
 .../workflows/dart_skills_lint_workflow.yaml  | 29 ++++++++++++++++---
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/dart_skills_lint_workflow.yaml b/.github/workflows/dart_skills_lint_workflow.yaml
index 58e4619c..7fbcd362 100644
--- a/.github/workflows/dart_skills_lint_workflow.yaml
+++ b/.github/workflows/dart_skills_lint_workflow.yaml
@@ -54,10 +54,31 @@ jobs:
           dart run bin/main.dart
 
   coverage:
-    uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/dart_package.yml@v1 # zizmor: ignore[unpinned-uses]
-    with:
-      working_directory: tool/dart_skills_lint
-      min_coverage: 73
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
+        with:
+          sdk: stable
+
+      - run: dart pub get
+
+      - name: Collect coverage
+        run: dart test --coverage=coverage
+
+      - name: Format coverage to LCOV
+        run: dart run coverage:format_coverage --lcov --in=coverage --out=coverage/lcov.info --report-on=lib
+
+      # Action steps do not inherit defaults.run.working-directory, so this
+      # path is relative to the repository root.
+      - name: Enforce coverage threshold
+        uses: VeryGoodOpenSource/very_good_coverage@c953fca3e24a915e111cc6f55f03f756dcb3964c # v3 # zizmor: ignore[archived-uses]
+        with:
+          path: tool/dart_skills_lint/coverage/lcov.info
+          min_coverage: 73
+          exclude: '**/*.g.dart'
 
   formatting:
     runs-on: ubuntu-latest

From bb86ea49dbe273c1879ab91e7a4bc01542ccd09d Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 13:44:39 -0700
Subject: [PATCH 10/13] use full commit SHA

---
 .github/workflows/dart_skills_lint_workflow.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dart_skills_lint_workflow.yaml b/.github/workflows/dart_skills_lint_workflow.yaml
index 7fbcd362..745c0543 100644
--- a/.github/workflows/dart_skills_lint_workflow.yaml
+++ b/.github/workflows/dart_skills_lint_workflow.yaml
@@ -74,7 +74,7 @@ jobs:
       # Action steps do not inherit defaults.run.working-directory, so this
       # path is relative to the repository root.
       - name: Enforce coverage threshold
-        uses: VeryGoodOpenSource/very_good_coverage@c953fca3e24a915e111cc6f55f03f756dcb3964c # v3 # zizmor: ignore[archived-uses]
+        uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/dart_package.yml@<86e2d68bb1e27b2518e4a2277205d23d21cb413c
         with:
           path: tool/dart_skills_lint/coverage/lcov.info
           min_coverage: 73

From d8f8dffdad14650c32695533b83bf7f33409714c Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 13:46:25 -0700
Subject: [PATCH 11/13] Fix coverage tool

---
 .../workflows/dart_skills_lint_workflow.yaml  | 30 ++++---------------
 1 file changed, 5 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/dart_skills_lint_workflow.yaml b/.github/workflows/dart_skills_lint_workflow.yaml
index 745c0543..d3eba232 100644
--- a/.github/workflows/dart_skills_lint_workflow.yaml
+++ b/.github/workflows/dart_skills_lint_workflow.yaml
@@ -54,31 +54,11 @@ jobs:
           dart run bin/main.dart
 
   coverage:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
-        with:
-          sdk: stable
-
-      - run: dart pub get
-
-      - name: Collect coverage
-        run: dart test --coverage=coverage
-
-      - name: Format coverage to LCOV
-        run: dart run coverage:format_coverage --lcov --in=coverage --out=coverage/lcov.info --report-on=lib
-
-      # Action steps do not inherit defaults.run.working-directory, so this
-      # path is relative to the repository root.
-      - name: Enforce coverage threshold
-        uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/dart_package.yml@<86e2d68bb1e27b2518e4a2277205d23d21cb413c
-        with:
-          path: tool/dart_skills_lint/coverage/lcov.info
-          min_coverage: 73
-          exclude: '**/*.g.dart'
+    uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/dart_package.yml@v86e2d68bb1e27b2518e4a2277205d23d21cb413c
+    with:
+      working_directory: tool/dart_skills_lint
+      min_coverage: 73
+      exclude: '**/*.g.dart'
 
   formatting:
     runs-on: ubuntu-latest

From b7006300912e29fe4d3f0de05d1d996427cbee6a Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 13:48:30 -0700
Subject: [PATCH 12/13] Fix unpinned-uses error by stripping leading 'v' from
 40-character commit SHA

---
 .github/workflows/dart_skills_lint_workflow.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dart_skills_lint_workflow.yaml b/.github/workflows/dart_skills_lint_workflow.yaml
index d3eba232..2999f802 100644
--- a/.github/workflows/dart_skills_lint_workflow.yaml
+++ b/.github/workflows/dart_skills_lint_workflow.yaml
@@ -54,7 +54,7 @@ jobs:
           dart run bin/main.dart
 
   coverage:
-    uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/dart_package.yml@v86e2d68bb1e27b2518e4a2277205d23d21cb413c
+    uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/dart_package.yml@86e2d68bb1e27b2518e4a2277205d23d21cb413c # v1
     with:
       working_directory: tool/dart_skills_lint
       min_coverage: 73

From 922cba5e6715766552d6fe4f5b10f00db1a76ec6 Mon Sep 17 00:00:00 2001
From: John Ryan <ryjohn@google.com>
Date: Fri, 31 Jul 2026 13:52:12 -0700
Subject: [PATCH 13/13] Add explanation for zizmore: ignore comments

---
 .github/workflows/block-dart-skills-prs.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/block-dart-skills-prs.yaml b/.github/workflows/block-dart-skills-prs.yaml
index d48f1887..32aadf1f 100644
--- a/.github/workflows/block-dart-skills-prs.yaml
+++ b/.github/workflows/block-dart-skills-prs.yaml
@@ -4,9 +4,9 @@ permissions:
   contents: read
   pull-requests: write
 
-# zizmor: ignore[dangerous-triggers]
+# zizmor: ignore[dangerous-triggers] - {Needed to detect when Dart skills are modified}
 on:
-  # zizmor: ignore[dangerous-triggers]
+  # zizmor: ignore[dangerous-triggers] - {Needed to detect when Dart skills are modified}
   pull_request_target:
     types: [opened, synchronize, reopened]
     paths: