Visitar URL original
fix(ci): harden some workflows by jtmcdole · Pull Request #189087 · flutter/flutter · GitHub
Skip to content

fix(ci): harden some workflows - #189087

Merged
jtmcdole merged 3 commits into
masterfrom
workflow_harden
Jul 8, 2026
Merged

fix(ci): harden some workflows#189087
jtmcdole merged 3 commits into
masterfrom
workflow_harden

Conversation

@jtmcdole

@jtmcdole jtmcdole commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

In prep for Google Workflow Scanner; harden flutter workflows:

~/.local/bin/zizmor --gh-token=$(gh auth token) .github/workflow

fixes: #189096

@jtmcdole Coder
fix(ci): harden some workflows
b6990e0 
`~/.local/bin/zizmor --gh-token=$(gh auth token)  .github/workflow`
@flutter-dashboard flutter-dashboard Bot added the CICD Run CI/CD label Jul 7, 2026
@gemini-code-assist

gemini-code-assist Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

@jtmcdole

jtmcdole commented Jul 7, 2026

Copy link
Copy Markdown
Member Author

@eyebrowsoffire - easy_cp and revert are the biggest changes - breaking up some multi-line "run" blocks into single run blocks so they can individually be audited.

eyebrowsoffire
eyebrowsoffire requested changes Jul 7, 2026
View reviewed changes

@eyebrowsoffire eyebrowsoffire left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! A few small requests.

Comment thread .github/workflows/easy-cp.yml Resolved
Comment thread .github/workflows/revert.yml Resolved
Comment thread .github/workflows/revert.yml Resolved
morganchen12
morganchen12 reviewed Jul 7, 2026
View reviewed changes
Comment thread .github/workflows/roll-dart-dependencies.yml Resolved
Comment thread .github/workflows/sync-engine-version.yml Resolved
@jtmcdole
jtmcdole requested a review from eyebrowsoffire July 7, 2026 23:34
Piinks
Piinks previously approved these changes Jul 8, 2026
View reviewed changes

@Piinks Piinks left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Freeze and no-response workflows LGTM

@jtmcdole
jtmcdole requested a review from Piinks July 8, 2026 18:04
jtmcdole added 2 commits July 8, 2026 11:16
@jtmcdole
Reviewer comments / more cleanup:
3504441 
1. Exit early (cancel workflow runs) instead of stringing along if
   statements
2. Reduce GITHUB_ENV usage - we can write files or use GITHUB_OUTPUT for
   identified steps.
3. Use `env:` blocks more
4. Cleanup `jq` uses and use latest `revert` reason - also case
   insensitive `ReAsOn FOR ReVeRT:`
@jtmcdole
GH_TOKEN in steps that need it:
cf70e16 
1. Created universal `Configure git` steps that run `gh auth setup-git`
2. Converted all GITHUB_TOKEN envs to GH_TOKEN which is used by `gh` (and now git calls that need auth)
3. Made sure GH_TOKEN was available on all lines matches for `(\bgh\b |git (push|fetch|pull))`
4. Moved most `env: ` blocks at the end, which apparently is style for github. - it made it easier to scan "does this run block call? next does it have GH_TOKEN env?"
@jtmcdole

jtmcdole commented Jul 8, 2026

Copy link
Copy Markdown
Member Author

last commit message for reviewers:

GH_TOKEN in steps that need it:

  1. Created universal Configure git steps that run gh auth setup-git
  2. Converted all GITHUB_TOKEN envs to GH_TOKEN which is used by gh (and now git calls that need auth)
  3. Made sure GH_TOKEN was available on all lines matches for (\bgh\b |git (push|fetch|pull))
  4. Moved most env: blocks at the end, which apparently is style for github. - it made it easier to scan "does this run block call? next does it have GH_TOKEN env?"

@jtmcdole jtmcdole added the autosubmit Merge PR when tree becomes green via auto submit App label Jul 8, 2026
@auto-submit

auto-submit Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

autosubmit label was removed for flutter/flutter/189087, because This PR has not met approval requirements for merging. Changes were requested by {eyebrowsoffire}, please make the needed changes and resubmit this PR.
The PR author is a member of flutter-hackers and needs 1 more review(s) in order to merge this PR.

  • Merge guidelines: A PR needs at least one approved review if the author is already part of flutter-hackers or two member reviews if the author is not a member of flutter-hackers before re-applying the autosubmit label. Reviewers: If you left a comment approving, please use the "approve" review action instead.

@auto-submit auto-submit Bot removed the autosubmit Merge PR when tree becomes green via auto submit App label Jul 8, 2026
eyebrowsoffire
eyebrowsoffire approved these changes Jul 8, 2026
View reviewed changes

@eyebrowsoffire eyebrowsoffire left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@jtmcdole
jtmcdole added this pull request to the merge queue Jul 8, 2026
Merged via the queue into master with commit 6cbdfac Jul 8, 2026
26 of 27 checks passed
@jtmcdole
jtmcdole deleted the workflow_harden branch July 8, 2026 19:59
This was referenced Jul 9, 2026
Closed
Closed
Closed
Closed
This was referenced Jul 9, 2026
Closed
Closed
Merged
auto-submit Bot pushed a commit to flutter/packages that referenced this pull request Jul 10, 2026
@engine-flutter-autoroll
Manual roll Flutter from 91939cc4db78 to dc2a8703e12b (50 revisions) (#…
7a9fb61 
…12169)

Manual roll Flutter from 91939cc4db78 to dc2a8703e12b (50 revisions)

Manual roll requested by bensonluk@google.com

flutter/flutter@91939cc...dc2a870

2026-07-09 chris@bracken.jp [ios,macos] Update swiftc.py flags to match swiftc (flutter/flutter#189174)
2026-07-09 jesswon@google.com [AGP 9] Update Warn Version to AGP 9+ (flutter/flutter#189109)
2026-07-09 154381524+flutteractionsbot@users.noreply.github.com Sync CHANGELOG.md from stable (flutter/flutter#189203)
2026-07-09 mdebbar@google.com [web] Roll Chrome to 145 (framework) (flutter/flutter#182861)
2026-07-09 engine-flutter-autoroll@skia.org Roll Packages from 52d84d6 to 20928d5 (6 revisions) (flutter/flutter#189194)
2026-07-09 zhongliu88889@gmail.com [web] Avoid absolute positioning for base CanvasKit canvas (flutter/flutter#188337)
2026-07-09 engine-flutter-autoroll@skia.org Roll Dart SDK from cdb7217e65aa to a11fb7ed40a5 (6 revisions) (flutter/flutter#189195)
2026-07-09 matt.kosarek@canonical.com Fix dereference of nullptr in the moved-to-rect signal in the Linux embedder (flutter/flutter#189152)
2026-07-09 katelovett@google.com Fix data for design packages (flutter/flutter#189140)
2026-07-09 engine-flutter-autoroll@skia.org Roll Skia from 7b42d1251d54 to ab3a7b98c94d (2 revisions) (flutter/flutter#189181)
2026-07-09 engine-flutter-autoroll@skia.org Roll Skia from 05d9d214e0b7 to 7b42d1251d54 (2 revisions) (flutter/flutter#189175)
2026-07-09 engine-flutter-autoroll@skia.org Roll Skia from 542c8bdd7f4f to 05d9d214e0b7 (4 revisions) (flutter/flutter#189169)
2026-07-09 97480502+b-luk@users.noreply.github.com UberSDF rect handling for thin (line-like) rectangles (flutter/flutter#188821)
2026-07-09 engine-flutter-autoroll@skia.org Roll Skia from dd572c07f63c to 542c8bdd7f4f (4 revisions) (flutter/flutter#189160)
2026-07-09 markzipan@google.com [flutter_tools] Fix hot restart for WASM web builds (flutter/flutter#187898)
2026-07-08 robert.ancell@canonical.com Split FlViewRenderer into OpenGL and software backends (flutter/flutter#188824)
2026-07-08 awolff@google.com Promote android_hardware_smoke_tests out of bringup in CI (flutter/flutter#189081)
2026-07-08 engine-flutter-autoroll@skia.org Roll Skia from 8df24be66531 to dd572c07f63c (4 revisions) (flutter/flutter#189150)
2026-07-08 matt.kosarek@canonical.com Expose LinuxWindowRegistrar on _window_linux.dart in order to better support out of tree LinuxWindowingOwners (flutter/flutter#188917)
2026-07-08 137456488+flutter-pub-roller-bot@users.noreply.github.com Roll pub packages (flutter/flutter#189149)
2026-07-08 codefu@google.com fix(ci): harden some workflows (flutter/flutter#189087)
2026-07-08 engine-flutter-autoroll@skia.org Roll Skia from 51a62da33da0 to 8df24be66531 (1 revision) (flutter/flutter#189139)
2026-07-08 iinozemtsev@google.com Roll Dart SDK to Dart 3.13 beta3 (flutter/flutter#189122)
2026-07-08 digvijaysinghiam@gmail.com [flutter_tools] Don't crash on non-UTF-8 plugin pubspec.yaml (flutter/flutter#188976)
2026-07-08 bkonyi@google.com [flutter_tools] Watch transitive #include headers for FragmentProgram hot reload (flutter/flutter#187945)
2026-07-08 engine-flutter-autoroll@skia.org Roll Skia from 040d9f55de00 to 51a62da33da0 (1 revision) (flutter/flutter#189135)
2026-07-08 engine-flutter-autoroll@skia.org Roll Packages from 92525f5 to 52d84d6 (7 revisions) (flutter/flutter#189134)
2026-07-08 bkonyi@google.com [flutter_tools] Forcefully kill hung subprocesses 5 seconds after timeout (flutter/flutter#187178)
2026-07-08 malo.allee@gmail.com Expose the app's build name and number as compile-time constants (flutter/flutter#187935)
2026-07-08 engine-flutter-autoroll@skia.org Roll Skia from 1ff92f879815 to 040d9f55de00 (1 revision) (flutter/flutter#189131)
2026-07-08 engine-flutter-autoroll@skia.org Roll Skia from 6137414bef5c to 1ff92f879815 (6 revisions) (flutter/flutter#189126)
2026-07-08 brackenavaron@gmail.com [test cross imports] More test/rendering + flutter_test/test fixes (flutter/flutter#188954)
2026-07-08 112751483+shivanshu877@users.noreply.github.com engine: explain why each candidate build was skipped in Flutter web loader (flutter/flutter#186254)
2026-07-08 chris@bracken.jp vscode: add missing unicode.h (flutter/flutter#189102)
2026-07-08 engine-flutter-autoroll@skia.org Roll Fuchsia Linux SDK from 7RjQJBW3m-3Jl-7jr... to QcRFUtvCw2EobfJ8s... (flutter/flutter#189104)
2026-07-08 engine-flutter-autoroll@skia.org Roll Skia from 075fbe4778d9 to 6137414bef5c (10 revisions) (flutter/flutter#189106)
2026-07-08 112751483+shivanshu877@users.noreply.github.com engine: warn on WASM load failure when not crossOriginIsolated (flutter/flutter#186252)
2026-07-08 engine-flutter-autoroll@skia.org Roll Dart SDK from c9bccc09e733 to db2155f56bf3 (2 revisions) (flutter/flutter#189105)
2026-07-08 bkonyi@google.com [flutter_tools] Prevent interactive device selection in machine mode (flutter/flutter#188267)
2026-07-08 bkonyi@google.com [flutter_tools] Fix wireless ADB device discovery when serial contains spaces (flutter/flutter#187943)
2026-07-07 zhongliu88889@gmail.com [web] Fix grouped autofill on iOS Chrome (flutter/flutter#187459)
2026-07-07 rmolivares@renzo-olivares.dev Fix TextSelectionOverlay crash when layout is degenerate (flutter/flutter#188672)
2026-07-07 87962825+kyungilcho@users.noreply.github.com [flutter_tools] Provision Android NDK in the main Gradle invocation (flutter/flutter#186337)
2026-07-07 awolff@google.com Android_hardware_smoke_test: Migrate to AGP 9 (flutter/flutter#189082)
...
@Piinks Piinks mentioned this pull request Nov 6, 2026
Merged
11 tasks done
auto-submit Bot pushed a commit to flutter/packages that referenced this pull request Nov 9, 2026
@Piinks
[ci] Remove pull_request_target workflows (#13581)
9c7676b 
Removes the remaining `pull_request_target` triggers in `.github/workflows/`:

- Replaces `pull_request_label.yml` with `labeler-trigger.yml` (`pull_request`) and `labeler.yml` (`workflow_run`), matching flutter/flutter#195536.
- Removes `remove_cicd.yml`, since `CICD` label management is now handled in Cocoon (matching flutter/flutter#189087).

Part of flutter/flutter#193185

## Pre-Review Checklist

**Note**: The Flutter team is currently trialing the use of [Gemini Code Assist for GitHub](https://developers.google.com/gemini-code-assist/docs/review-github-code). Comments from the `gemini-code-assist` bot should not be taken as authoritative feedback from the Flutter team. If you find its comments useful you can update your code accordingly, but if you are unsure or disagree with the feedback, please feel free to wait for a Flutter team member's review for guidance on which automated comments should be addressed.

[^1]: Regular contributors who have demonstrated familiarity with the repository guidelines only need to comment if the PR is not auto-exempted by repo tooling.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eyebrowsoffire eyebrowsoffire eyebrowsoffire approved these changes
@gaaclarke gaaclarke Awaiting requested review from gaaclarke
@Piinks Piinks Awaiting requested review from Piinks
+1 more reviewer
@morganchen12 morganchen12 morganchen12 left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

CICD Run CI/CD

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

ci: harden flutter workflow actions with zizmor

4 participants

@jtmcdole @morganchen12 @Piinks @eyebrowsoffire