From 5cad5e6b5166f31b2fb372c89d87d40efaa09953 Mon Sep 17 00:00:00 2001 From: Digvijaysinh Chauhan Date: Tue, 25 Aug 2026 11:04:58 +0530 Subject: [PATCH 1/6] ci(security): resolve all Zizmor audit warnings in dependabot and workflow triggers --- .github/dependabot.yml | 12 ++++++++++++ .github/workflows/dependabot-auto-merge.yml | 2 +- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6fe29ff..f644086 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,6 +8,8 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7 groups: all-github-actions: patterns: [ "*" ] @@ -24,6 +26,8 @@ updates: directory: "/packages/white_label_kit" schedule: interval: "weekly" + cooldown: + default-days: 7 labels: - "p: white_label_kit" - "infra: dependencies" @@ -32,6 +36,8 @@ updates: directory: "/packages/dig_cli" schedule: interval: "weekly" + cooldown: + default-days: 7 labels: - "p: dig_cli" - "infra: dependencies" @@ -40,6 +46,8 @@ updates: directory: "/packages/apple_sign_in_plugin/apple_sign_in_plugin" schedule: interval: "weekly" + cooldown: + default-days: 7 labels: - "p: apple_sign_in_plugin" - "infra: dependencies" @@ -48,6 +56,8 @@ updates: directory: "/packages/apple_sign_in_plugin/apple_sign_in_plugin_platform_interface" schedule: interval: "weekly" + cooldown: + default-days: 7 labels: - "p: apple_sign_in_plugin" - "infra: dependencies" @@ -56,6 +66,8 @@ updates: directory: "/script/tool" schedule: interval: "weekly" + cooldown: + default-days: 7 labels: - "infra: dependencies" - "infra: workflows" diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index a07d7d7..1ee3cb4 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -16,7 +16,7 @@ name: Dependabot Auto-Merge on: - pull_request_target: + pull_request: types: [opened, synchronize, reopened] permissions: From 9bf43bef38078a8b67a04ebfc2642422e768ac81 Mon Sep 17 00:00:00 2001 From: Digvijaysinh Chauhan Date: Tue, 25 Aug 2026 11:07:31 +0530 Subject: [PATCH 2/6] ci: retain safe pull_request_target trigger for dependabot auto-merge without checkout --- .github/workflows/dependabot-auto-merge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 1ee3cb4..a07d7d7 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -16,7 +16,7 @@ name: Dependabot Auto-Merge on: - pull_request: + pull_request_target: types: [opened, synchronize, reopened] permissions: From 6e337cab4cb8f52cd1649f8cf54c48033b185584 Mon Sep 17 00:00:00 2001 From: Digvijaysinh Chauhan Date: Tue, 25 Aug 2026 11:10:55 +0530 Subject: [PATCH 3/6] ci(security): resolve all 14 Zizmor audit findings across all workflows --- .github/workflows/batch_release_pr.yml | 4 ++-- .github/workflows/dependabot-auto-merge.yml | 2 +- .github/workflows/dependency-review.yml | 4 ++-- .github/workflows/issue-labeler.yml | 2 +- .github/workflows/pr-title.yml | 9 ++------- .github/workflows/pull_request_label.yml | 4 ++-- .github/workflows/release.yml | 2 +- .github/workflows/reusable_release.yml | 2 +- .github/workflows/sync_release_pr.yml | 2 +- .github/workflows/validate.yml | 2 +- .github/workflows/zizmor.yml | 2 +- 11 files changed, 15 insertions(+), 20 deletions(-) diff --git a/.github/workflows/batch_release_pr.yml b/.github/workflows/batch_release_pr.yml index c8da644..6158db3 100644 --- a/.github/workflows/batch_release_pr.yml +++ b/.github/workflows/batch_release_pr.yml @@ -17,7 +17,7 @@ jobs: release_branch: ${{ steps.create-branch.outputs.release_branch }} # e.g. release-go_router-17.2.2, returned by branches-for-batch-release tool. steps: - name: checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: token: ${{ secrets.FLUTTERGITHUBBOT_TOKEN }} persist-credentials: false @@ -58,7 +58,7 @@ jobs: contents: write steps: - name: checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: ref: ${{ env.HEAD_BRANCH_NAME }} persist-credentials: false diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index a07d7d7..70dcf28 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -27,7 +27,7 @@ jobs: auto-merge: name: auto-merge runs-on: ubuntu-latest - if: github.actor == 'dependabot[bot]' + if: github.event.pull_request.user.login == 'dependabot[bot]' steps: - name: Fetch Dependabot metadata id: metadata diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 2a69271..381dd7f 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -22,12 +22,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.0 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false - name: Dependency Review - uses: actions/dependency-review-action@1e966ba708e4b64bb0c9bfb7abb5a232840be16a # v4.7.3 + uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0 with: fail-on-severity: high comment-summary-in-pr: on-failure diff --git a/.github/workflows/issue-labeler.yml b/.github/workflows/issue-labeler.yml index 4b5dfa4..bea2bb5 100644 --- a/.github/workflows/issue-labeler.yml +++ b/.github/workflows/issue-labeler.yml @@ -26,7 +26,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 937b6ad..3d4d772 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -10,16 +10,11 @@ name: PR Title on: - # pull_request_target is used (instead of pull_request) so this check can - # post a status on PRs from forks, where the default pull_request token is - # read-only. This is safe here: the job only reads PR title metadata via - # the GitHub API, and never checks out or executes PR code. - pull_request_target: + pull_request: types: [opened, edited, synchronize, reopened] permissions: - pull-requests: read - statuses: write + pull-requests: write jobs: pr-title: diff --git a/.github/workflows/pull_request_label.yml b/.github/workflows/pull_request_label.yml index 51d8bef..fe94dc6 100644 --- a/.github/workflows/pull_request_label.yml +++ b/.github/workflows/pull_request_label.yml @@ -9,7 +9,7 @@ name: Pull Request Labeler on: - pull_request_target: + pull_request: types: [opened, synchronize, reopened, closed] # Declare default permissions as read only. @@ -21,7 +21,7 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 + - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0 with: repo-token: "${{ secrets.GITHUB_TOKEN }}" sync-labels: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c805a23..b7170e5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,7 +32,7 @@ jobs: steps: # Checks out a copy of the repo. - name: Check out code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 # Fetch all history so the tool can get all the tags to determine version. persist-credentials: false diff --git a/.github/workflows/reusable_release.yml b/.github/workflows/reusable_release.yml index 2fddf30..fec6c43 100644 --- a/.github/workflows/reusable_release.yml +++ b/.github/workflows/reusable_release.yml @@ -25,7 +25,7 @@ jobs: steps: # Checks out a copy of the repo. - name: Check out code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 # Fetch all history so the tool can get all the tags to determine version. ref: ${{ inputs.branch-name }} diff --git a/.github/workflows/sync_release_pr.yml b/.github/workflows/sync_release_pr.yml index 2e53e55..18c74f2 100644 --- a/.github/workflows/sync_release_pr.yml +++ b/.github/workflows/sync_release_pr.yml @@ -17,7 +17,7 @@ jobs: pull-requests: write steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 # Fetch history to allow branch comparison persist-credentials: false diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index a5588a6..3c5a94f 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -22,7 +22,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index d4e3b0e..881e1d1 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -32,7 +32,7 @@ jobs: security-events: write steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false From 229540c30b6d09786cc97b0240c87e877347bd8a Mon Sep 17 00:00:00 2001 From: Digvijaysinh Chauhan Date: Tue, 25 Aug 2026 11:17:44 +0530 Subject: [PATCH 4/6] ci: ensure Sourcery AI findings check only evaluates current commit --- .github/workflows/pr-metadata.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-metadata.yml b/.github/workflows/pr-metadata.yml index ce49530..cd59ebe 100644 --- a/.github/workflows/pr-metadata.yml +++ b/.github/workflows/pr-metadata.yml @@ -138,10 +138,11 @@ jobs: if (r.user && r.state !== 'COMMENTED') latestReviewByUser.set(r.user.login, r.state); } - // Check Sourcery AI reviews for blocking issues + // Check Sourcery AI reviews for blocking issues on the current commit const sourceryReviews = reviews.filter((r) => (r.user?.login || '').includes('sourcery-ai')); const latestSourceryReview = sourceryReviews.length > 0 ? sourceryReviews[sourceryReviews.length - 1] : null; - const sourceryHasIssues = latestSourceryReview && ( + const sourceryReviewIsCurrent = latestSourceryReview && (latestSourceryReview.commit_id === pr.head.sha || !latestSourceryReview.commit_id); + const sourceryHasIssues = sourceryReviewIsCurrent && ( /found \d+ issue/i.test(latestSourceryReview.body || '') || /blocking findings/i.test(latestSourceryReview.body || '') ); From 481a87ee235a4ede70ae9e775b063495d22e2453 Mon Sep 17 00:00:00 2001 From: Digvijaysinh Chauhan Date: Tue, 25 Aug 2026 11:19:18 +0530 Subject: [PATCH 5/6] ci: automatically remove autosubmit label when changes are requested or CI fails --- .github/workflows/pr-metadata.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/pr-metadata.yml b/.github/workflows/pr-metadata.yml index cd59ebe..ab8cd79 100644 --- a/.github/workflows/pr-metadata.yml +++ b/.github/workflows/pr-metadata.yml @@ -182,6 +182,11 @@ jobs: for (const s of STATUS_LABELS) removeLabel(s); setLabel(status); + // Automatically remove autosubmit label if changes are requested, CI fails, or PR is blocked + if (['status:changes-requested', 'status:ci-failed', 'status:blocked'].includes(status)) { + removeLabel('autosubmit'); + } + // ---- apply label changes ---- const finalLabels = [...nextLabels].sort(); if (JSON.stringify(finalLabels) !== JSON.stringify([...existingLabels].sort())) { From 2c5169856a93fcf889c8e15119b8a4b46793c005 Mon Sep 17 00:00:00 2001 From: Digvijaysinh Chauhan Date: Tue, 25 Aug 2026 11:21:23 +0530 Subject: [PATCH 6/6] ci: verify Sourcery AI status using its official check run conclusion --- .github/workflows/pr-metadata.yml | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/.github/workflows/pr-metadata.yml b/.github/workflows/pr-metadata.yml index ab8cd79..a34a5b7 100644 --- a/.github/workflows/pr-metadata.yml +++ b/.github/workflows/pr-metadata.yml @@ -138,24 +138,19 @@ jobs: if (r.user && r.state !== 'COMMENTED') latestReviewByUser.set(r.user.login, r.state); } - // Check Sourcery AI reviews for blocking issues on the current commit - const sourceryReviews = reviews.filter((r) => (r.user?.login || '').includes('sourcery-ai')); - const latestSourceryReview = sourceryReviews.length > 0 ? sourceryReviews[sourceryReviews.length - 1] : null; - const sourceryReviewIsCurrent = latestSourceryReview && (latestSourceryReview.commit_id === pr.head.sha || !latestSourceryReview.commit_id); - const sourceryHasIssues = sourceryReviewIsCurrent && ( - /found \d+ issue/i.test(latestSourceryReview.body || '') || - /blocking findings/i.test(latestSourceryReview.body || '') - ); - - const hasChangesRequested = [...latestReviewByUser.values()].includes('CHANGES_REQUESTED') || sourceryHasIssues; - const hasApproval = [...latestReviewByUser.values()].includes('APPROVED'); - const { data: checkRuns } = await github.rest.checks.listForRef({ owner: context.repo.owner, repo: context.repo.repo, ref: pr.head.sha, }); + // Check Sourcery AI status via its official check run + const sourceryRun = checkRuns.check_runs.find((c) => c.name.toLowerCase().includes('sourcery')); + const sourceryHasIssues = sourceryRun && sourceryRun.status === 'completed' && sourceryRun.conclusion === 'failure'; + + const hasChangesRequested = [...latestReviewByUser.values()].includes('CHANGES_REQUESTED') || sourceryHasIssues; + const hasApproval = [...latestReviewByUser.values()].includes('APPROVED'); + // Deduplicate and keep only the latest run for each unique check name const latestCheckByName = new Map(); for (const c of checkRuns.check_runs) {