From b2ac28380d0f9e73d740feda08d736a99603be6d Mon Sep 17 00:00:00 2001 From: John McDole Date: Wed, 15 Jul 2026 09:32:21 -0700 Subject: [PATCH 1/2] fix(ci): harden some workflows in core-packages ~/.local/bin/zizmor --gh-token=$(gh auth token) .github/workflows ~/.local/bin/zizmor --gh-token=$(gh auth token) .github/actions --- .github/actions/set-up-repo/action.yaml | 2 +- .github/workflows/multi_version_tasks.yaml | 11 ++++++++--- .github/workflows/pull_request_label.yml | 4 +++- .github/workflows/release.yml | 19 +++++++++++++++---- .github/workflows/validate_repo.yaml | 22 +++++++++++++++------- .github/workflows/windows_unit_tests.yaml | 5 +++++ 6 files changed, 47 insertions(+), 16 deletions(-) diff --git a/.github/actions/set-up-repo/action.yaml b/.github/actions/set-up-repo/action.yaml index eadd423b..98e8886a 100644 --- a/.github/actions/set-up-repo/action.yaml +++ b/.github/actions/set-up-repo/action.yaml @@ -9,7 +9,7 @@ runs: steps: - name: Set up Dart (${{ inputs.dart-sdk }}) - uses: dart-lang/setup-dart@v1 + uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2 with: sdk: ${{ inputs.dart-sdk }} diff --git a/.github/workflows/multi_version_tasks.yaml b/.github/workflows/multi_version_tasks.yaml index 4ef9fcc4..2ee6ee8d 100644 --- a/.github/workflows/multi_version_tasks.yaml +++ b/.github/workflows/multi_version_tasks.yaml @@ -14,6 +14,10 @@ on: pull_request: branches: [ main ] +# Declare default permissions as read only. +permissions: + contents: read + jobs: analyze: name: Analyze and Test - Dart ${{ matrix.dart-sdk }} @@ -34,6 +38,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: fetch-depth: 0 + persist-credentials: false - name: Set up environment and tooling id: setup @@ -42,18 +47,18 @@ jobs: dart-sdk: ${{ matrix.dart-sdk }} - name: Run Dart unit tests - if: ${{ !cancelled() && steps.setup.outcome == 'success' }} + if: !cancelled() && steps.setup.outcome == 'success' run: | dart pub global run flutter_plugin_tools test - name: Run analyze id: analyze - if: ${{ !cancelled() && steps.setup.outcome == 'success' }} + if: !cancelled() && steps.setup.outcome == 'success' run: | dart pub global run flutter_plugin_tools analyze - name: Run downgraded analyze # If regular analysis failed, no need to run downgraded analysis. - if: ${{ !cancelled() && steps.setup.outcome == 'success' && steps.analyze.outcome == 'success' }} + if: !cancelled() && steps.setup.outcome == 'success' && steps.analyze.outcome == 'success' run: | dart pub global run flutter_plugin_tools analyze --downgrade diff --git a/.github/workflows/pull_request_label.yml b/.github/workflows/pull_request_label.yml index 9be2e1d6..d930dfa0 100644 --- a/.github/workflows/pull_request_label.yml +++ b/.github/workflows/pull_request_label.yml @@ -13,11 +13,13 @@ on: types: [opened, synchronize, reopened, closed] # Declare default permissions as read only. -permissions: read-all +permissions: + contents: read jobs: label: permissions: + contents: read pull-requests: write runs-on: ubuntu-latest steps: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 454833bc..ca2f4c90 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,7 +5,8 @@ on: - main # Declare default permissions as read only. -permissions: read-all +permissions: + contents: read jobs: release: @@ -21,6 +22,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: fetch-depth: 0 # Fetch all history so the tool can get all the tags to determine version. + persist-credentials: false # Set up the latest stable release of Dart and tooling. - name: Set up environment and tooling id: setup @@ -53,9 +55,18 @@ jobs: # verbose:true will produce too many logs that hang github actions web UI. verbose: false + - name: Configure Git + run: | + gh auth setup-git + git config --global user.name "$USER_NAME" + git config --global user.email "$USER_EMAIL" + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + USER_NAME: ${{ secrets.USER_NAME }} + USER_EMAIL: ${{ secrets.USER_EMAIL }} - name: run release run: | - git config set --global user.name "${{ secrets.USER_NAME }}" - git config set --global user.email "${{ secrets.USER_EMAIL }}" dart pub global run flutter_plugin_tools publish --all-changed --base-sha=HEAD~ --skip-confirmation --remote=origin - env: {PUB_CREDENTIALS: "${{ secrets.PUB_CREDENTIALS }}"} + env: + PUB_CREDENTIALS: ${{ secrets.PUB_CREDENTIALS }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/validate_repo.yaml b/.github/workflows/validate_repo.yaml index 9b5d0a32..56e08934 100644 --- a/.github/workflows/validate_repo.yaml +++ b/.github/workflows/validate_repo.yaml @@ -14,6 +14,11 @@ on: pull_request: branches: [ main ] +# Declare default permissions as read only. +permissions: + contents: read + pull-requests: read + jobs: analyze: name: validate @@ -25,6 +30,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: fetch-depth: 0 + persist-credentials: false - name: Set up environment and tooling id: setup @@ -38,33 +44,35 @@ jobs: # missing version/CHANGELOG detection since PR-level overrides aren't available # in post-submit. - name: Run 'validate' for general repo best practices - if: ${{ !cancelled() && steps.setup.outcome == 'success' }} + if: !cancelled() && steps.setup.outcome == 'success' run: | - if [ "${{ github.event_name }}" == "push" ]; then + if [ "$EVENT_NAME" = "push" ]; then dart pub global run flutter_plugin_tools validate --ignore-platform-interface-breaks else - dart pub global run flutter_plugin_tools validate --check-for-missing-changes --pr-labels="$(gh api --jq '.labels.[].name' /repos/flutter/core-packages/pulls/${{ github.event.number }} | paste -sd ',' -)" + dart pub global run flutter_plugin_tools validate --check-for-missing-changes --pr-labels="$(gh api --jq '.labels.[].name' /repos/flutter/core-packages/pulls/$PR_NUMBER | paste -sd ',' -)" fi env: GH_TOKEN: ${{ github.token }} + EVENT_NAME: ${{ github.event_name }} + PR_NUMBER: ${{ github.event.number }} - name: Run 'format' to check for formatting violations - if: ${{ !cancelled() && steps.setup.outcome == 'success' }} + if: !cancelled() && steps.setup.outcome == 'success' run: | dart pub global run flutter_plugin_tools format --fail-on-change --no-swift - name: Run 'update-excerpts' to check for outdated README snippets - if: ${{ !cancelled() && steps.setup.outcome == 'success' }} + if: !cancelled() && steps.setup.outcome == 'success' run: | dart pub global run flutter_plugin_tools update-excerpts - name: Run 'license-check' to check for license issues - if: ${{ !cancelled() && steps.setup.outcome == 'success' }} + if: !cancelled() && steps.setup.outcome == 'success' run: | dart pub global run flutter_plugin_tools license-check # This is a relatively slow test, so keep it last. - name: Run 'publish-check' to make sure everything is in a publishable state - if: ${{ !cancelled() && steps.setup.outcome == 'success' }} + if: !cancelled() && steps.setup.outcome == 'success' run: | dart pub global run flutter_plugin_tools publish-check --allow-pre-release diff --git a/.github/workflows/windows_unit_tests.yaml b/.github/workflows/windows_unit_tests.yaml index e0e8fc77..d29b34af 100644 --- a/.github/workflows/windows_unit_tests.yaml +++ b/.github/workflows/windows_unit_tests.yaml @@ -14,6 +14,10 @@ on: pull_request: branches: [ main ] +# Declare default permissions as read only. +permissions: + contents: read + jobs: analyze: name: Windows Test - Dart Stable @@ -24,6 +28,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: fetch-depth: 0 + persist-credentials: false - name: Set up environment and tooling uses: ./.github/actions/set-up-repo From 1b3b9f22ab8bb79bedaf02dcee89ddc0ad99a3ef Mon Sep 17 00:00:00 2001 From: John McDole Date: Wed, 15 Jul 2026 15:20:11 -0700 Subject: [PATCH 2/2] revert if: ${{}} --- .github/workflows/multi_version_tasks.yaml | 6 +++--- .github/workflows/validate_repo.yaml | 10 +++++----- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/multi_version_tasks.yaml b/.github/workflows/multi_version_tasks.yaml index 2ee6ee8d..8d7f435f 100644 --- a/.github/workflows/multi_version_tasks.yaml +++ b/.github/workflows/multi_version_tasks.yaml @@ -47,18 +47,18 @@ jobs: dart-sdk: ${{ matrix.dart-sdk }} - name: Run Dart unit tests - if: !cancelled() && steps.setup.outcome == 'success' + if: ${{ !cancelled() && steps.setup.outcome == 'success' }} run: | dart pub global run flutter_plugin_tools test - name: Run analyze id: analyze - if: !cancelled() && steps.setup.outcome == 'success' + if: ${{ !cancelled() && steps.setup.outcome == 'success' }} run: | dart pub global run flutter_plugin_tools analyze - name: Run downgraded analyze # If regular analysis failed, no need to run downgraded analysis. - if: !cancelled() && steps.setup.outcome == 'success' && steps.analyze.outcome == 'success' + if: ${{ !cancelled() && steps.setup.outcome == 'success' && steps.analyze.outcome == 'success' }} run: | dart pub global run flutter_plugin_tools analyze --downgrade diff --git a/.github/workflows/validate_repo.yaml b/.github/workflows/validate_repo.yaml index 56e08934..c73c431b 100644 --- a/.github/workflows/validate_repo.yaml +++ b/.github/workflows/validate_repo.yaml @@ -44,7 +44,7 @@ jobs: # missing version/CHANGELOG detection since PR-level overrides aren't available # in post-submit. - name: Run 'validate' for general repo best practices - if: !cancelled() && steps.setup.outcome == 'success' + if: ${{ !cancelled() && steps.setup.outcome == 'success' }} run: | if [ "$EVENT_NAME" = "push" ]; then dart pub global run flutter_plugin_tools validate --ignore-platform-interface-breaks @@ -57,22 +57,22 @@ jobs: PR_NUMBER: ${{ github.event.number }} - name: Run 'format' to check for formatting violations - if: !cancelled() && steps.setup.outcome == 'success' + if: ${{ !cancelled() && steps.setup.outcome == 'success' }} run: | dart pub global run flutter_plugin_tools format --fail-on-change --no-swift - name: Run 'update-excerpts' to check for outdated README snippets - if: !cancelled() && steps.setup.outcome == 'success' + if: ${{ !cancelled() && steps.setup.outcome == 'success' }} run: | dart pub global run flutter_plugin_tools update-excerpts - name: Run 'license-check' to check for license issues - if: !cancelled() && steps.setup.outcome == 'success' + if: ${{ !cancelled() && steps.setup.outcome == 'success' }} run: | dart pub global run flutter_plugin_tools license-check # This is a relatively slow test, so keep it last. - name: Run 'publish-check' to make sure everything is in a publishable state - if: !cancelled() && steps.setup.outcome == 'success' + if: ${{ !cancelled() && steps.setup.outcome == 'success' }} run: | dart pub global run flutter_plugin_tools publish-check --allow-pre-release