fix(ci): harden some workflows in core-packages

.github/actions/set-up-repo/action.yaml

@@ -9,7 +9,7 @@ runs:
   steps:
 
     - name: Set up Dart (${{ inputs.dart-sdk }})
-      uses: dart-lang/setup-dart@v1
+      uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
       with:
         sdk: ${{ inputs.dart-sdk }}
 

.github/workflows/multi_version_tasks.yaml

@@ -14,6 +14,10 @@ on:
   pull_request:
     branches: [ main ]
 
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze and Test - Dart ${{ matrix.dart-sdk }}
@@ -34,6 +38,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up environment and tooling
         id: setup

.github/workflows/pull_request_label.yml

@@ -13,11 +13,13 @@ on:
     types: [opened, synchronize, reopened, closed]
 
 # Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   label:
     permissions:
+      contents: read
       pull-requests: write
     runs-on: ubuntu-latest
     steps:

.github/workflows/release.yml

@@ -5,7 +5,8 @@ on:
       - main
 
 # Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   release:
@@ -21,6 +22,7 @@ jobs:
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       with:
         fetch-depth: 0 # Fetch all history so the tool can get all the tags to determine version.
+        persist-credentials: false
     # Set up the latest stable release of Dart and tooling.
     - name: Set up environment and tooling
       id: setup
@@ -53,9 +55,18 @@ jobs:
         # verbose:true will produce too many logs that hang github actions web UI.
         verbose: false
 
+    - name: Configure Git
+      run: |
+        gh auth setup-git
+        git config --global user.name "$USER_NAME"
+        git config --global user.email "$USER_EMAIL"
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        USER_NAME: ${{ secrets.USER_NAME }}
+        USER_EMAIL: ${{ secrets.USER_EMAIL }}
     - name: run release
       run: |
-        git config set --global user.name "${{ secrets.USER_NAME }}"
-        git config set --global user.email "${{ secrets.USER_EMAIL }}"
         dart pub global run flutter_plugin_tools publish --all-changed --base-sha=HEAD~ --skip-confirmation --remote=origin
-      env: {PUB_CREDENTIALS: "${{ secrets.PUB_CREDENTIALS }}"}
+      env:
+        PUB_CREDENTIALS: ${{ secrets.PUB_CREDENTIALS }}
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/validate_repo.yaml

@@ -14,6 +14,11 @@ on:
   pull_request:
     branches: [ main ]
 
+# Declare default permissions as read only.
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   analyze:
     name: validate
@@ -25,6 +30,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up environment and tooling
         id: setup
@@ -40,13 +46,15 @@ jobs:
       - name: Run 'validate' for general repo best practices
         if: ${{ !cancelled() && steps.setup.outcome == 'success' }}
         run: |
-          if [ "${{ github.event_name }}" == "push" ]; then
+          if [ "$EVENT_NAME" = "push" ]; then
             dart pub global run flutter_plugin_tools validate --ignore-platform-interface-breaks
           else
-            dart pub global run flutter_plugin_tools validate --check-for-missing-changes --pr-labels="$(gh api --jq '.labels.[].name' /repos/flutter/core-packages/pulls/${{ github.event.number }} | paste -sd ',' -)"
+            dart pub global run flutter_plugin_tools validate --check-for-missing-changes --pr-labels="$(gh api --jq '.labels.[].name' /repos/flutter/core-packages/pulls/$PR_NUMBER | paste -sd ',' -)"
           fi
         env:
           GH_TOKEN: ${{ github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR_NUMBER: ${{ github.event.number }}
 
       - name: Run 'format' to check for formatting violations
         if: ${{ !cancelled() && steps.setup.outcome == 'success' }}

.github/workflows/windows_unit_tests.yaml

@@ -14,6 +14,10 @@ on:
   pull_request:
     branches: [ main ]
 
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Windows Test - Dart Stable
@@ -24,6 +28,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up environment and tooling
         uses: ./.github/actions/set-up-repo