From 2307c4b39222736d50671abb1b281aaf6a730656 Mon Sep 17 00:00:00 2001 From: Giancarlo Buenaflor Date: Fri, 24 Jul 2026 19:41:12 +0200 Subject: [PATCH 1/2] ci: Add dependency audit safeguards Pin mutable dependency inputs and add CI checks that report Pub dependency health, review vulnerable updates, and enforce immutable Action references. Fixes #410 Refs SDK-1316 Co-authored-by: Cursor --- .github/workflows/dependency-audit.yml | 43 ++++++++++++++++++++ .github/workflows/release-comment-issues.yml | 2 +- pubspec.yaml | 2 +- 3 files changed, 45 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/dependency-audit.yml diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml new file mode 100644 index 0000000..3a247a5 --- /dev/null +++ b/.github/workflows/dependency-audit.yml @@ -0,0 +1,43 @@ +name: Dependency Audit + +on: + push: + branches: + - main + - release/** + pull_request: + +permissions: + contents: read + +jobs: + pub-dependencies: + name: Pub dependency report + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # pin@v1.7.2 + - name: Resolve dependencies + run: dart pub get + - name: Report dependency graph + run: dart pub deps + - name: Report outdated dependencies + run: dart pub outdated + + dependency-review: + name: Dependency review + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 + with: + fail-on-severity: moderate + fail-on-scopes: runtime, development + + action-pinning: + name: Enforce Action SHA pins + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + - uses: zgosalvez/github-actions-ensure-sha-pinned-actions@3db98c0363e2fa5df3e1c4c471777a7c10b24cc9 # v5.0.5 diff --git a/.github/workflows/release-comment-issues.yml b/.github/workflows/release-comment-issues.yml index 0eeff26..54a64ef 100644 --- a/.github/workflows/release-comment-issues.yml +++ b/.github/workflows/release-comment-issues.yml @@ -33,7 +33,7 @@ jobs: && !contains(steps.get_version.outputs.version, '-alpha.') && !contains(steps.get_version.outputs.version, '-rc.') - uses: getsentry/release-comment-issues-gh-action@v1 + uses: getsentry/release-comment-issues-gh-action@52e08022ca721e701515ede89edd224b63b180eb # v1 with: github_token: ${{ secrets.GITHUB_TOKEN }} version: ${{ steps.get_version.outputs.version }} diff --git a/pubspec.yaml b/pubspec.yaml index 320e5fd..77d3cf8 100644 --- a/pubspec.yaml +++ b/pubspec.yaml @@ -21,7 +21,7 @@ dependencies: glob: ^2.1.3 dev_dependencies: - lints: '>=3.0.0' + lints: ^6.1.0 test: ^1.21.6 platforms: From d63e8c01e03f88e83567543976dde06e12c9a395 Mon Sep 17 00:00:00 2001 From: Giancarlo Buenaflor Date: Fri, 24 Jul 2026 19:45:22 +0200 Subject: [PATCH 2/2] ci: Drop redundant dependency audit workflow Sentry already runs an org-level Dependency Review workflow and Socket Security on every pull request, and Dependabot opens dependency update PRs, so the added jobs duplicated existing coverage. Co-authored-by: Cursor --- .github/workflows/dependency-audit.yml | 43 -------------------------- 1 file changed, 43 deletions(-) delete mode 100644 .github/workflows/dependency-audit.yml diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml deleted file mode 100644 index 3a247a5..0000000 --- a/.github/workflows/dependency-audit.yml +++ /dev/null @@ -1,43 +0,0 @@ -name: Dependency Audit - -on: - push: - branches: - - main - - release/** - pull_request: - -permissions: - contents: read - -jobs: - pub-dependencies: - name: Pub dependency report - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # pin@v1.7.2 - - name: Resolve dependencies - run: dart pub get - - name: Report dependency graph - run: dart pub deps - - name: Report outdated dependencies - run: dart pub outdated - - dependency-review: - name: Dependency review - if: github.event_name == 'pull_request' - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 - with: - fail-on-severity: moderate - fail-on-scopes: runtime, development - - action-pinning: - name: Enforce Action SHA pins - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - - uses: zgosalvez/github-actions-ensure-sha-pinned-actions@3db98c0363e2fa5df3e1c4c471777a7c10b24cc9 # v5.0.5