Skip to content

fix(ci): harden some workflows in packages#12178

Merged
auto-submit[bot] merged 4 commits into
flutter:mainfrom
jtmcdole:zizmor
Jul 15, 2026
Merged

fix(ci): harden some workflows in packages#12178
auto-submit[bot] merged 4 commits into
flutter:mainfrom
jtmcdole:zizmor

Conversation

@jtmcdole

@jtmcdole jtmcdole commented Jul 10, 2026

Copy link
Copy Markdown
Member

fixes flutter/flutter#189098

~/.local/bin/zizmor --gh-token=$(gh auth token)  .github/workflow
 INFO zizmor: 🌈 zizmor v1.25.2
 INFO audit: zizmor: 🌈 completed .github/workflows/batch_release_pr.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/go_router_batch.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/internals/install_flutter/action.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/pull_request_label.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/release.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/release_from_branches.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/remove_cicd.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/reusable_release.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/sync_release_pr.yml
No findings to report. Good job! (2 ignored, 56 suppressed)

jtmcdole added 2 commits July 10, 2026 15:00
fixes #189098

```
~/.local/bin/zizmor --gh-token=$(gh auth token)  .github/workflow
 INFO zizmor: 🌈 zizmor v1.25.2
 INFO audit: zizmor: 🌈 completed .github/workflows/batch_release_pr.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/go_router_batch.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/internals/install_flutter/action.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/pull_request_label.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/release.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/release_from_branches.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/remove_cicd.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/reusable_release.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/sync_release_pr.yml
No findings to report. Good job! (2 ignored, 56 suppressed)
```
@jtmcdole jtmcdole added the CICD Run CI/CD label Jul 10, 2026
@jtmcdole
jtmcdole marked this pull request as ready for review July 10, 2026 22:19
@jtmcdole
jtmcdole requested a review from stuartmorgan-g July 10, 2026 22:19
@gemini-code-assist

Copy link
Copy Markdown
Contributor

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

Comment thread .github/workflows/internals/install_flutter/action.yml
Comment thread .github/workflows/release.yml Outdated
Comment thread .github/workflows/reusable_release.yml Outdated
@github-actions github-actions Bot removed the CICD Run CI/CD label Jul 14, 2026
@jtmcdole
jtmcdole requested a review from stuartmorgan-g July 14, 2026 16:07

@stuartmorgan-g stuartmorgan-g left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with one more comment.

persist-credentials: false
- name: Create batch release PR
run: |
gh pr create \

@stuartmorgan-g stuartmorgan-g Jul 14, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, I missed this before: don't we need to call gh auth setup-git here before doing other gh commands in this structure?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's easy to confuse: gh auth setup-git modifies the ~/.gitconfig by default and that was done on line 35.

https://cli.github.com/manual/gh_auth_setup-git

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see, I didn't realize things would carry across tasks.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wait, its different jobs isn't it?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is different jobs - since those run in different VMs, it requires auth setup twice. Done.

@jtmcdole jtmcdole added autosubmit Merge PR when tree becomes green via auto submit App and removed autosubmit Merge PR when tree becomes green via auto submit App labels Jul 14, 2026
@jtmcdole jtmcdole added autosubmit Merge PR when tree becomes green via auto submit App CICD Run CI/CD labels Jul 14, 2026
@auto-submit
auto-submit Bot merged commit 8b0286d into flutter:main Jul 15, 2026
89 checks passed
pull Bot pushed a commit to ZainCheung/flutter that referenced this pull request Jul 17, 2026
…er#189659)

flutter/packages@9f95026...4fdc766

2026-07-17 [email protected] [pigeon] allow empty class
(flutter/packages#12181)
2026-07-16 [email protected] [material_ui,
cupertino_ui] Rename l10n macros (flutter/packages#12211)
2026-07-16 [email protected] [ci] Remove manual SwiftPM enabling
step (flutter/packages#12204)
2026-07-16 [email protected] [google_maps_flutter] Fix XCUITest on
stable (flutter/packages#12214)
2026-07-16 [email protected] [google_maps_flutter] Convert
XCUITests to Swift (flutter/packages#12208)
2026-07-16 [email protected] [material_ui] Rename the
remaining templates (flutter/packages#12210)
2026-07-15 [email protected] [material_ui,
cupertino_ui] Rename macro names to package names
(flutter/packages#12198)
2026-07-15 [email protected] [material_ui] Fix upstream localization
test (flutter/packages#12207)
2026-07-15 [email protected] [material_ui, cupertino_ui]
Localizations (flutter/packages#12119)
2026-07-15 [email protected] fix(ci): harden some workflows in packages
(flutter/packages#12178)
2026-07-15 [email protected] Roll Flutter from
846664b to fc1ad95 (18 revisions) (flutter/packages#12203)

If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://autoroll.skia.org/r/flutter-packages-flutter-autoroll
Please CC [email protected] on the revert to ensure that a
human
is aware of the problem.

To file a bug in Flutter:
https://github.com/flutter/flutter/issues/new/choose

To report a problem with the AutoRoller itself, please file a bug:
https://issues.skia.org/issues/new?component=1389291&template=1850622

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

autosubmit Merge PR when tree becomes green via auto submit App CICD Run CI/CD

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ci: harden packages workflow actions with zizmor

2 participants