chore(deps): Pin lints bound and release-comment action SHA#415
Open
buenaflor wants to merge 2 commits into
Open
chore(deps): Pin lints bound and release-comment action SHA#415buenaflor wants to merge 2 commits into
buenaflor wants to merge 2 commits into
Conversation
Pin mutable dependency inputs and add CI checks that report Pub dependency health, review vulnerable updates, and enforce immutable Action references. Fixes #410 Refs SDK-1316 Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR strengthens dependency and CI supply-chain hygiene for the sentry_dart_plugin repository by tightening Dart dev tooling bounds and adding CI checks that surface dependency state and enforce GitHub Action SHA pinning.
Changes:
- Bound the
lintsdev dependency to a caret range (^6.1.0) instead of an open-ended lower bound. - Pinned
getsentry/release-comment-issues-gh-actionto a full commit SHA. - Added a new “Dependency Audit” workflow to report Dart dependency state, run GitHub’s Dependency Review on PRs, and enforce full-SHA Action pins.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
pubspec.yaml |
Bounds the lints dev dependency to a stable semver range. |
.github/workflows/release-comment-issues.yml |
Pins the external Action to a full commit SHA for supply-chain safety. |
.github/workflows/dependency-audit.yml |
Adds CI jobs for pub dependency reporting, dependency review on PRs, and Action SHA pin enforcement. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sentry already runs an org-level Dependency Review workflow and Socket Security on every pull request, and Dependabot opens dependency update PRs, so the added jobs duplicated existing coverage. Co-authored-by: Cursor <cursoragent@cursor.com>
buenaflor
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bounds the floating
lintsdev dependency at^6.1.0and pins the last mutable GitHub Action reference (getsentry/release-comment-issues-gh-action@v1) to its full commit SHA.These were the only two actionable gaps found while auditing this repo for dependency pinning. Everything else already holds up: all other Actions were SHA-pinned, no dependency comes from a Git ref, and Dependabot covers both the
pubandgithub-actionsecosystems.pubspec.lockstays uncommitted on purpose. This is a published library package, and Dart's guidance is that regular packages should not check in a lockfile so they keep resolving against the range they advertise to consumers.An earlier revision of this PR also added a
Dependency Auditworkflow. It was dropped because the org-levelDependency Reviewworkflow and Socket Security already scan dependencies on every PR, and Dependabot already surfaces available updates.Fixes #410
Refs SDK-1316