Skip to content

fix(ci): harden some workflows in packages - #12178

Merged
auto-submit[bot] merged 4 commits into
flutter:mainfrom
jtmcdole:zizmor
Jul 15, 2026
Merged

fix(ci): harden some workflows in packages#12178
auto-submit[bot] merged 4 commits into
flutter:mainfrom
jtmcdole:zizmor

Conversation

@jtmcdole

@jtmcdolejtmcdole commented Jul 10, 2026

Copy link
Copy Markdown
Member

fixesflutter/flutter#189098

~/.local/bin/zizmor --gh-token=$(gh auth token) .github/workflow
INFO zizmor: 🌈 zizmor v1.25.2
INFO audit: zizmor: 🌈 completed .github/workflows/batch_release_pr.yml
INFO audit: zizmor: 🌈 completed .github/workflows/go_router_batch.yml
INFO audit: zizmor: 🌈 completed .github/workflows/internals/install_flutter/action.yml
INFO audit: zizmor: 🌈 completed .github/workflows/pull_request_label.yml
INFO audit: zizmor: 🌈 completed .github/workflows/release.yml
INFO audit: zizmor: 🌈 completed .github/workflows/release_from_branches.yml
INFO audit: zizmor: 🌈 completed .github/workflows/remove_cicd.yml
INFO audit: zizmor: 🌈 completed .github/workflows/reusable_release.yml
INFO audit: zizmor: 🌈 completed .github/workflows/sync_release_pr.yml
No findings to report. Good job! (2 ignored, 56 suppressed)

fixes #189098
```
~/.local/bin/zizmor --gh-token=$(gh auth token) .github/workflow
INFO zizmor: 🌈 zizmor v1.25.2
INFO audit: zizmor: 🌈 completed .github/workflows/batch_release_pr.yml
INFO audit: zizmor: 🌈 completed .github/workflows/go_router_batch.yml
INFO audit: zizmor: 🌈 completed .github/workflows/internals/install_flutter/action.yml
INFO audit: zizmor: 🌈 completed .github/workflows/pull_request_label.yml
INFO audit: zizmor: 🌈 completed .github/workflows/release.yml
INFO audit: zizmor: 🌈 completed .github/workflows/release_from_branches.yml
INFO audit: zizmor: 🌈 completed .github/workflows/remove_cicd.yml
INFO audit: zizmor: 🌈 completed .github/workflows/reusable_release.yml
INFO audit: zizmor: 🌈 completed .github/workflows/sync_release_pr.yml
No findings to report. Good job! (2 ignored, 56 suppressed)
```
@jtmcdolejtmcdole added the CICD Run CI/CD label Jul 10, 2026
@jtmcdole
jtmcdole marked this pull request as ready for review July 10, 2026 22:19
@gemini-code-assist

Copy link
Copy Markdown
Contributor

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

Comment thread.github/workflows/internals/install_flutter/action.yml
Comment thread.github/workflows/release.yml Outdated
Comment thread.github/workflows/reusable_release.yml Outdated
@github-actionsgithub-actionsBot removed the CICD Run CI/CD label Jul 14, 2026

@stuartmorgan-gstuartmorgan-g left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with one more comment.

persist-credentials: false
- name: Create batch release PR
run: |
gh pr create \

@stuartmorgan-gstuartmorgan-gJul 14, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, I missed this before: don't we need to call gh auth setup-git here before doing other gh commands in this structure?

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's easy to confuse: gh auth setup-git modifies the ~/.gitconfig by default and that was done on line 35.

https://cli.github.com/manual/gh_auth_setup-git

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see, I didn't realize things would carry across tasks.

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wait, its different jobs isn't it?

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is different jobs - since those run in different VMs, it requires auth setup twice. Done.

@jtmcdolejtmcdole added autosubmit Merge PR when tree becomes green via auto submit App and removed autosubmit Merge PR when tree becomes green via auto submit App labels Jul 14, 2026
@jtmcdolejtmcdole added autosubmit Merge PR when tree becomes green via auto submit App CICD Run CI/CD labels Jul 14, 2026
@auto-submit
auto-submitBot merged commit 8b0286d into flutter:mainJul 15, 2026
89 checks passed
pullBot pushed a commit to ZainCheung/flutter that referenced this pull request Jul 17, 2026
…er#189659)
flutter/packages@9f95026...4fdc766
2026-07-17 tarrinneal@gmail.com [pigeon] allow empty class
(flutter/packages#12181)
2026-07-16 dkwingsmt@users.noreply.github.com [material_ui,
cupertino_ui] Rename l10n macros (flutter/packages#12211)
2026-07-16 stuartmorgan@google.com [ci] Remove manual SwiftPM enabling
step (flutter/packages#12204)
2026-07-16 stuartmorgan@google.com [google_maps_flutter] Fix XCUITest on
stable (flutter/packages#12214)
2026-07-16 stuartmorgan@google.com [google_maps_flutter] Convert
XCUITests to Swift (flutter/packages#12208)
2026-07-16 dkwingsmt@users.noreply.github.com [material_ui] Rename the
remaining templates (flutter/packages#12210)
2026-07-15 dkwingsmt@users.noreply.github.com [material_ui,
cupertino_ui] Rename macro names to package names
(flutter/packages#12198)
2026-07-15 katelovett@google.com [material_ui] Fix upstream localization
test (flutter/packages#12207)
2026-07-15 stuartmorgan@google.com [material_ui, cupertino_ui]
Localizations (flutter/packages#12119)
2026-07-15 codefu@google.com fix(ci): harden some workflows in packages
(flutter/packages#12178)
2026-07-15 engine-flutter-autoroll@skia.org Roll Flutter from
846664b to fc1ad95 (18 revisions) (flutter/packages#12203)
If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://autoroll.skia.org/r/flutter-packages-flutter-autoroll
Please CC flutter-ecosystem@google.com on the revert to ensure that a
human
is aware of the problem.
To file a bug in Flutter:
https://github.com/flutter/flutter/issues/new/choose
To report a problem with the AutoRoller itself, please file a bug:
https://issues.skia.org/issues/new?component=1389291&template=1850622
Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

autosubmitMerge PR when tree becomes green via auto submit AppCICDRun CI/CD

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ci: harden packages workflow actions with zizmor

2 participants

@jtmcdole@stuartmorgan-g