From fb68106da9859d86babad9795a6cf4ad68564ccc Mon Sep 17 00:00:00 2001 From: iota9star Date: Thu, 13 Aug 2026 22:18:08 +0800 Subject: [PATCH] chore(ci): pin actions, harden credentials, scope permissions --- .github/workflows/build-all-platforms.yml | 109 ++++++++++++++-------- 1 file changed, 70 insertions(+), 39 deletions(-) diff --git a/.github/workflows/build-all-platforms.yml b/.github/workflows/build-all-platforms.yml index 40e6947..acf228e 100644 --- a/.github/workflows/build-all-platforms.yml +++ b/.github/workflows/build-all-platforms.yml @@ -10,9 +10,7 @@ on: workflow_dispatch: permissions: - contents: write - pages: write - id-token: write + contents: read # Allow only one concurrent deployment concurrency: @@ -51,10 +49,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false - name: Setup Flutter - uses: subosito/flutter-action@v2 + uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2 with: channel: ${{ env.FLUTTER_CHANNEL }} cache: true @@ -79,8 +79,9 @@ jobs: release_name: ${{ steps.tag.outputs.name }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: + persist-credentials: false fetch-depth: 0 - name: Generate release tag @@ -102,16 +103,18 @@ jobs: arch: [arm64, x64, universal] steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false - name: Setup Flutter - uses: subosito/flutter-action@v2 + uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2 with: channel: ${{ env.FLUTTER_CHANNEL }} cache: true - name: Setup Java - uses: actions/setup-java@v4 + uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4 with: distribution: 'zulu' java-version: '17' @@ -122,21 +125,27 @@ jobs: - name: Generate Android keystore run: | - cd ${{ env.EXAMPLE_DIR }}/android/app + cd $EXAMPLE_DIR/android/app if [ -n "$KEYSTORE_BASE64" ]; then - echo "$KEYSTORE_BASE64" | base64 -d > ${{ env.ANDROID_KEYSTORE_FILE }} + echo "$KEYSTORE_BASE64" | base64 -d > $ANDROID_KEYSTORE_FILE else - keytool -genkey -v -keystore ${{ env.ANDROID_KEYSTORE_FILE }} \ - -alias ${{ env.ANDROID_KEY_ALIAS }} \ + keytool -genkey -v -keystore $ANDROID_KEYSTORE_FILE \ + -alias $ANDROID_KEY_ALIAS \ -keyalg RSA -keysize 2048 -validity 36135 \ - -storepass '${{ env.ANDROID_KEYSTORE_SECRET }}' \ - -keypass '${{ env.ANDROID_KEY_PASSWORD }}' \ - -dname '${{ env.ANDROID_KEY_DNAME }}' + -storepass "$ANDROID_KEYSTORE_SECRET" \ + -keypass "$ANDROID_KEY_PASSWORD" \ + -dname "$ANDROID_KEY_DNAME" fi - if ! grep -q "${{ env.ANDROID_KEYSTORE_FILE }}" .gitignore 2>/dev/null; then - echo "${{ env.ANDROID_KEYSTORE_FILE }}" >> .gitignore + if ! grep -q "$ANDROID_KEYSTORE_FILE" .gitignore 2>/dev/null; then + echo "$ANDROID_KEYSTORE_FILE" >> .gitignore fi env: + EXAMPLE_DIR: ${{ env.EXAMPLE_DIR }} + ANDROID_KEYSTORE_FILE: ${{ env.ANDROID_KEYSTORE_FILE }} + ANDROID_KEY_ALIAS: ${{ env.ANDROID_KEY_ALIAS }} + ANDROID_KEYSTORE_SECRET: ${{ env.ANDROID_KEYSTORE_SECRET }} + ANDROID_KEY_PASSWORD: ${{ env.ANDROID_KEY_PASSWORD }} + ANDROID_KEY_DNAME: ${{ env.ANDROID_KEY_DNAME }} KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }} - name: Configure Android signing @@ -190,7 +199,7 @@ jobs: fi - name: Upload APK artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: android-${{ matrix.arch }} path: | @@ -207,10 +216,12 @@ jobs: needs: prepare steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false - name: Setup Flutter - uses: subosito/flutter-action@v2 + uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2 with: channel: ${{ env.FLUTTER_CHANNEL }} cache: true @@ -242,7 +253,7 @@ jobs: rm -rf Payload - name: Upload iOS artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: ios path: | @@ -258,10 +269,12 @@ jobs: needs: prepare steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false - name: Setup Flutter - uses: subosito/flutter-action@v2 + uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2 with: channel: ${{ env.FLUTTER_CHANNEL }} cache: true @@ -313,7 +326,7 @@ jobs: Compress-Archive -Path build\windows\x64\runner\Release\* -DestinationPath ${{ env.PROJECT_SLUG }}-windows.zip - name: Upload Windows artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: windows path: | @@ -330,10 +343,12 @@ jobs: needs: prepare steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false - name: Setup Flutter - uses: subosito/flutter-action@v2 + uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2 with: channel: ${{ env.FLUTTER_CHANNEL }} cache: true @@ -358,7 +373,7 @@ jobs: tar -czf ${{ env.PROJECT_SLUG }}-linux.tar.gz -C build/linux/x64/release/bundle . - name: Upload Linux artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: linux path: ${{ env.EXAMPLE_DIR }}/${{ env.PROJECT_SLUG }}-linux.tar.gz @@ -372,10 +387,12 @@ jobs: needs: prepare steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false - name: Setup Flutter - uses: subosito/flutter-action@v2 + uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2 with: channel: ${{ env.FLUTTER_CHANNEL }} cache: true @@ -404,7 +421,7 @@ jobs: rm -rf dmg - name: Upload macOS artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: macos path: | @@ -416,14 +433,20 @@ jobs: # Web build ##################################### build-web: + permissions: + contents: read + pages: write + id-token: write runs-on: ubuntu-latest needs: test-library steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false - name: Setup Flutter - uses: subosito/flutter-action@v2 + uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2 with: channel: ${{ env.FLUTTER_CHANNEL }} cache: true @@ -437,10 +460,10 @@ jobs: working-directory: ${{ env.EXAMPLE_DIR }} - name: Setup Pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d # v4 - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 with: path: ${{ env.EXAMPLE_DIR }}/build/web @@ -448,6 +471,10 @@ jobs: # Deploy to GitHub Pages ##################################### deploy-web: + permissions: + contents: read + pages: write + id-token: write environment: name: github-pages url: ${{ steps.deployment.outputs.page_url }} @@ -457,21 +484,25 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 ##################################### # Release all builds ##################################### release: + permissions: + contents: write runs-on: ubuntu-latest needs: [prepare, build-android, build-ios, build-windows, build-linux, build-macos] if: github.event_name == 'push' && github.ref == 'refs/heads/main' steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false - name: Download all artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: path: artifacts @@ -481,7 +512,7 @@ jobs: tree artifacts/ || ls -laR artifacts/ - name: Create Release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 with: tag_name: ${{ needs.prepare.outputs.release_tag }} name: ${{ needs.prepare.outputs.release_name }}