ci(security): resolve all Zizmor audit warnings in dependabot and workflow triggers

.github/dependabot.yml

@@ -8,6 +8,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       all-github-actions:
         patterns: [ "*" ]
@@ -24,6 +26,8 @@ updates:
     directory: "/packages/white_label_kit"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     labels:
       - "p: white_label_kit"
       - "infra: dependencies"
@@ -32,6 +36,8 @@ updates:
     directory: "/packages/dig_cli"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     labels:
       - "p: dig_cli"
       - "infra: dependencies"
@@ -40,6 +46,8 @@ updates:
     directory: "/packages/apple_sign_in_plugin/apple_sign_in_plugin"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     labels:
       - "p: apple_sign_in_plugin"
       - "infra: dependencies"
@@ -48,6 +56,8 @@ updates:
     directory: "/packages/apple_sign_in_plugin/apple_sign_in_plugin_platform_interface"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     labels:
       - "p: apple_sign_in_plugin"
       - "infra: dependencies"
@@ -56,6 +66,8 @@ updates:
     directory: "/script/tool"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     labels:
       - "infra: dependencies"
       - "infra: workflows"

.github/workflows/batch_release_pr.yml

@@ -17,7 +17,7 @@ jobs:
       release_branch: ${{ steps.create-branch.outputs.release_branch }} # e.g. release-go_router-17.2.2, returned by branches-for-batch-release tool.
     steps:
       - name: checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           token: ${{ secrets.FLUTTERGITHUBBOT_TOKEN }}
           persist-credentials: false
@@ -58,7 +58,7 @@ jobs:
       contents: write
     steps:
       - name: checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ env.HEAD_BRANCH_NAME }}
           persist-credentials: false

.github/workflows/dependabot-auto-merge.yml

@@ -27,7 +27,7 @@ jobs:
   auto-merge:
     name: auto-merge
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
       - name: Fetch Dependabot metadata
         id: metadata

.github/workflows/dependency-review.yml

@@ -22,12 +22,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@1e966ba708e4b64bb0c9bfb7abb5a232840be16a # v4.7.3
+        uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
         with:
           fail-on-severity: high
           comment-summary-in-pr: on-failure

.github/workflows/issue-labeler.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 

.github/workflows/pr-metadata.yml

@@ -138,23 +138,19 @@ jobs:
               if (r.user && r.state !== 'COMMENTED') latestReviewByUser.set(r.user.login, r.state);
             }
 
-            // Check Sourcery AI reviews for blocking issues
-            const sourceryReviews = reviews.filter((r) => (r.user?.login || '').includes('sourcery-ai'));
-            const latestSourceryReview = sourceryReviews.length > 0 ? sourceryReviews[sourceryReviews.length - 1] : null;
-            const sourceryHasIssues = latestSourceryReview && (
-              /found \d+ issue/i.test(latestSourceryReview.body || '') ||
-              /blocking findings/i.test(latestSourceryReview.body || '')
-            );
-
-            const hasChangesRequested = [...latestReviewByUser.values()].includes('CHANGES_REQUESTED') || sourceryHasIssues;
-            const hasApproval = [...latestReviewByUser.values()].includes('APPROVED');
-
             const { data: checkRuns } = await github.rest.checks.listForRef({
               owner: context.repo.owner,
               repo: context.repo.repo,
               ref: pr.head.sha,
             });
 
+            // Check Sourcery AI status via its official check run
+            const sourceryRun = checkRuns.check_runs.find((c) => c.name.toLowerCase().includes('sourcery'));
+            const sourceryHasIssues = sourceryRun && sourceryRun.status === 'completed' && sourceryRun.conclusion === 'failure';
+
+            const hasChangesRequested = [...latestReviewByUser.values()].includes('CHANGES_REQUESTED') || sourceryHasIssues;
+            const hasApproval = [...latestReviewByUser.values()].includes('APPROVED');
+
             // Deduplicate and keep only the latest run for each unique check name
             const latestCheckByName = new Map();
             for (const c of checkRuns.check_runs) {
@@ -181,6 +177,11 @@ jobs:
             for (const s of STATUS_LABELS) removeLabel(s);
             setLabel(status);
 
+            // Automatically remove autosubmit label if changes are requested, CI fails, or PR is blocked
+            if (['status:changes-requested', 'status:ci-failed', 'status:blocked'].includes(status)) {
+              removeLabel('autosubmit');
+            }
+
             // ---- apply label changes ----
             const finalLabels = [...nextLabels].sort();
             if (JSON.stringify(finalLabels) !== JSON.stringify([...existingLabels].sort())) {

.github/workflows/pr-title.yml

@@ -10,16 +10,11 @@
 name: PR Title
 
 on:
-  # pull_request_target is used (instead of pull_request) so this check can
-  # post a status on PRs from forks, where the default pull_request token is
-  # read-only. This is safe here: the job only reads PR title metadata via
-  # the GitHub API, and never checks out or executes PR code.
-  pull_request_target:
+  pull_request:
     types: [opened, edited, synchronize, reopened]
 
 permissions:
-  pull-requests: read
-  statuses: write
+  pull-requests: write
 
 jobs:
   pr-title:

.github/workflows/pull_request_label.yml

@@ -9,7 +9,7 @@
 name: Pull Request Labeler
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, reopened, closed]
 
 # Declare default permissions as read only.
@@ -21,7 +21,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           sync-labels: true

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
     steps:
     # Checks out a copy of the repo.
     - name: Check out code
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0 # Fetch all history so the tool can get all the tags to determine version.
         persist-credentials: false

.github/workflows/reusable_release.yml

@@ -25,7 +25,7 @@ jobs:
     steps:
     # Checks out a copy of the repo.
     - name: Check out code
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0 # Fetch all history so the tool can get all the tags to determine version.
         ref: ${{ inputs.branch-name }}

.github/workflows/sync_release_pr.yml

@@ -17,7 +17,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0 # Fetch history to allow branch comparison
           persist-credentials: false

.github/workflows/validate.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
           persist-credentials: false

.github/workflows/zizmor.yml

@@ -32,7 +32,7 @@ jobs:
       security-events: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false