Skip to content

fix(ci): harden some workflows#189087

Merged
jtmcdole merged 3 commits into
masterfrom
workflow_harden
Jul 8, 2026
Merged

fix(ci): harden some workflows#189087
jtmcdole merged 3 commits into
masterfrom
workflow_harden

Conversation

@jtmcdole

@jtmcdole jtmcdole commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

In prep for Google Workflow Scanner; harden flutter workflows:

~/.local/bin/zizmor --gh-token=$(gh auth token) .github/workflow

fixes: #189096

@jtmcdole
fix(ci): harden some workflows
b6990e0 
`~/.local/bin/zizmor --gh-token=$(gh auth token)  .github/workflow`
@flutter-dashboard flutter-dashboard Bot added the CICD Run CI/CD label Jul 7, 2026
@gemini-code-assist

gemini-code-assist Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

@jtmcdole

jtmcdole commented Jul 7, 2026

Copy link
Copy Markdown
Member Author

@eyebrowsoffire - easy_cp and revert are the biggest changes - breaking up some multi-line "run" blocks into single run blocks so they can individually be audited.

eyebrowsoffire
eyebrowsoffire requested changes Jul 7, 2026
View reviewed changes

@eyebrowsoffire eyebrowsoffire left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! A few small requests.

Comment thread .github/workflows/easy-cp.yml Outdated
Comment thread .github/workflows/revert.yml Outdated
Comment thread .github/workflows/revert.yml Outdated
morganchen12
morganchen12 reviewed Jul 7, 2026
View reviewed changes
Comment thread .github/workflows/roll-dart-dependencies.yml
Comment thread .github/workflows/sync-engine-version.yml
@jtmcdole
jtmcdole requested a review from eyebrowsoffire July 7, 2026 23:34
Piinks
Piinks previously approved these changes Jul 8, 2026
View reviewed changes

@Piinks Piinks left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Freeze and no-response workflows LGTM

@jtmcdole
jtmcdole requested a review from Piinks July 8, 2026 18:04
jtmcdole added 2 commits July 8, 2026 11:16
@jtmcdole
Reviewer comments / more cleanup:
3504441 
1. Exit early (cancel workflow runs) instead of stringing along if
   statements
2. Reduce GITHUB_ENV usage - we can write files or use GITHUB_OUTPUT for
   identified steps.
3. Use `env:` blocks more
4. Cleanup `jq` uses and use latest `revert` reason - also case
   insensitive `ReAsOn FOR ReVeRT:`
@jtmcdole
GH_TOKEN in steps that need it:
cf70e16 
1. Created universal `Configure git` steps that run `gh auth setup-git`
2. Converted all GITHUB_TOKEN envs to GH_TOKEN which is used by `gh` (and now git calls that need auth)
3. Made sure GH_TOKEN was available on all lines matches for `(\bgh\b |git (push|fetch|pull))`
4. Moved most `env: ` blocks at the end, which apparently is style for github. - it made it easier to scan "does this run block call? next does it have GH_TOKEN env?"
@jtmcdole

jtmcdole commented Jul 8, 2026

Copy link
Copy Markdown
Member Author

last commit message for reviewers:

GH_TOKEN in steps that need it:

  1. Created universal Configure git steps that run gh auth setup-git
  2. Converted all GITHUB_TOKEN envs to GH_TOKEN which is used by gh (and now git calls that need auth)
  3. Made sure GH_TOKEN was available on all lines matches for (\bgh\b |git (push|fetch|pull))
  4. Moved most env: blocks at the end, which apparently is style for github. - it made it easier to scan "does this run block call? next does it have GH_TOKEN env?"

@jtmcdole jtmcdole added the autosubmit Merge PR when tree becomes green via auto submit App label Jul 8, 2026
@auto-submit

auto-submit Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

autosubmit label was removed for flutter/flutter/189087, because This PR has not met approval requirements for merging. Changes were requested by {eyebrowsoffire}, please make the needed changes and resubmit this PR.
The PR author is a member of flutter-hackers and needs 1 more review(s) in order to merge this PR.

  • Merge guidelines: A PR needs at least one approved review if the author is already part of flutter-hackers or two member reviews if the author is not a member of flutter-hackers before re-applying the autosubmit label. Reviewers: If you left a comment approving, please use the "approve" review action instead.

@auto-submit auto-submit Bot removed the autosubmit Merge PR when tree becomes green via auto submit App label Jul 8, 2026
eyebrowsoffire
eyebrowsoffire approved these changes Jul 8, 2026
View reviewed changes

@eyebrowsoffire eyebrowsoffire left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@jtmcdole
jtmcdole added this pull request to the merge queue Jul 8, 2026
Merged via the queue into master with commit 6cbdfac Jul 8, 2026
26 of 27 checks passed
@jtmcdole
jtmcdole deleted the workflow_harden branch July 8, 2026 19:59
This was referenced Jul 9, 2026
Closed
Closed
Closed
Closed
This was referenced Jul 9, 2026
Closed
Closed
Merged
auto-submit Bot pushed a commit to flutter/packages that referenced this pull request Jul 10, 2026
@engine-flutter-autoroll
Manual roll Flutter from 91939cc4db78 to dc2a8703e12b (50 revisions) (#…
7a9fb61 
…12169)

Manual roll Flutter from 91939cc4db78 to dc2a8703e12b (50 revisions)

Manual roll requested by [email protected]

flutter/flutter@91939cc...dc2a870

2026-07-09 [email protected] [ios,macos] Update swiftc.py flags to match swiftc (flutter/flutter#189174)
2026-07-09 [email protected] [AGP 9] Update Warn Version to AGP 9+ (flutter/flutter#189109)
2026-07-09 [email protected] Sync CHANGELOG.md from stable (flutter/flutter#189203)
2026-07-09 [email protected] [web] Roll Chrome to 145 (framework) (flutter/flutter#182861)
2026-07-09 [email protected] Roll Packages from 52d84d6 to 20928d5 (6 revisions) (flutter/flutter#189194)
2026-07-09 [email protected] [web] Avoid absolute positioning for base CanvasKit canvas (flutter/flutter#188337)
2026-07-09 [email protected] Roll Dart SDK from cdb7217e65aa to a11fb7ed40a5 (6 revisions) (flutter/flutter#189195)
2026-07-09 [email protected] Fix dereference of nullptr in the moved-to-rect signal in the Linux embedder (flutter/flutter#189152)
2026-07-09 [email protected] Fix data for design packages (flutter/flutter#189140)
2026-07-09 [email protected] Roll Skia from 7b42d1251d54 to ab3a7b98c94d (2 revisions) (flutter/flutter#189181)
2026-07-09 [email protected] Roll Skia from 05d9d214e0b7 to 7b42d1251d54 (2 revisions) (flutter/flutter#189175)
2026-07-09 [email protected] Roll Skia from 542c8bdd7f4f to 05d9d214e0b7 (4 revisions) (flutter/flutter#189169)
2026-07-09 [email protected] UberSDF rect handling for thin (line-like) rectangles (flutter/flutter#188821)
2026-07-09 [email protected] Roll Skia from dd572c07f63c to 542c8bdd7f4f (4 revisions) (flutter/flutter#189160)
2026-07-09 [email protected] [flutter_tools] Fix hot restart for WASM web builds (flutter/flutter#187898)
2026-07-08 [email protected] Split FlViewRenderer into OpenGL and software backends (flutter/flutter#188824)
2026-07-08 [email protected] Promote android_hardware_smoke_tests out of bringup in CI (flutter/flutter#189081)
2026-07-08 [email protected] Roll Skia from 8df24be66531 to dd572c07f63c (4 revisions) (flutter/flutter#189150)
2026-07-08 [email protected] Expose LinuxWindowRegistrar on _window_linux.dart in order to better support out of tree LinuxWindowingOwners (flutter/flutter#188917)
2026-07-08 [email protected] Roll pub packages (flutter/flutter#189149)
2026-07-08 [email protected] fix(ci): harden some workflows (flutter/flutter#189087)
2026-07-08 [email protected] Roll Skia from 51a62da33da0 to 8df24be66531 (1 revision) (flutter/flutter#189139)
2026-07-08 [email protected] Roll Dart SDK to Dart 3.13 beta3 (flutter/flutter#189122)
2026-07-08 [email protected] [flutter_tools] Don't crash on non-UTF-8 plugin pubspec.yaml (flutter/flutter#188976)
2026-07-08 [email protected] [flutter_tools] Watch transitive #include headers for FragmentProgram hot reload (flutter/flutter#187945)
2026-07-08 [email protected] Roll Skia from 040d9f55de00 to 51a62da33da0 (1 revision) (flutter/flutter#189135)
2026-07-08 [email protected] Roll Packages from 92525f5 to 52d84d6 (7 revisions) (flutter/flutter#189134)
2026-07-08 [email protected] [flutter_tools] Forcefully kill hung subprocesses 5 seconds after timeout (flutter/flutter#187178)
2026-07-08 [email protected] Expose the app's build name and number as compile-time constants (flutter/flutter#187935)
2026-07-08 [email protected] Roll Skia from 1ff92f879815 to 040d9f55de00 (1 revision) (flutter/flutter#189131)
2026-07-08 [email protected] Roll Skia from 6137414bef5c to 1ff92f879815 (6 revisions) (flutter/flutter#189126)
2026-07-08 [email protected] [test cross imports] More test/rendering + flutter_test/test fixes (flutter/flutter#188954)
2026-07-08 [email protected] engine: explain why each candidate build was skipped in Flutter web loader (flutter/flutter#186254)
2026-07-08 [email protected] vscode: add missing unicode.h (flutter/flutter#189102)
2026-07-08 [email protected] Roll Fuchsia Linux SDK from 7RjQJBW3m-3Jl-7jr... to QcRFUtvCw2EobfJ8s... (flutter/flutter#189104)
2026-07-08 [email protected] Roll Skia from 075fbe4778d9 to 6137414bef5c (10 revisions) (flutter/flutter#189106)
2026-07-08 [email protected] engine: warn on WASM load failure when not crossOriginIsolated (flutter/flutter#186252)
2026-07-08 [email protected] Roll Dart SDK from c9bccc09e733 to db2155f56bf3 (2 revisions) (flutter/flutter#189105)
2026-07-08 [email protected] [flutter_tools] Prevent interactive device selection in machine mode (flutter/flutter#188267)
2026-07-08 [email protected] [flutter_tools] Fix wireless ADB device discovery when serial contains spaces (flutter/flutter#187943)
2026-07-07 [email protected] [web] Fix grouped autofill on iOS Chrome (flutter/flutter#187459)
2026-07-07 [email protected] Fix TextSelectionOverlay crash when layout is degenerate (flutter/flutter#188672)
2026-07-07 [email protected] [flutter_tools] Provision Android NDK in the main Gradle invocation (flutter/flutter#186337)
2026-07-07 [email protected] Android_hardware_smoke_test: Migrate to AGP 9 (flutter/flutter#189082)
...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eyebrowsoffire eyebrowsoffire eyebrowsoffire approved these changes
@gaaclarke gaaclarke Awaiting requested review from gaaclarke
@Piinks Piinks Awaiting requested review from Piinks
+1 more reviewer
@morganchen12 morganchen12 morganchen12 left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

CICD Run CI/CD

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

ci: harden flutter workflow actions with zizmor

4 participants

@jtmcdole @morganchen12 @Piinks @eyebrowsoffire