Tighten actions versions and permissions (#1342)

dart-lang · Feb 11, 2024 · f20956e · f20956e
1 parent 7dcb60d
commit f20956e
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 7 deletions.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -5,15 +5,17 @@ on:
     tags:
       - '[0-9]+.[0-9]+.[0-9]+*'
 
+permissions: read-all
+
 jobs:
   publish:
     permissions:
-      id-token: write # This is required for requesting the JWT
+      id-token: write # Required for authentication using OIDC
     runs-on: ubuntu-latest
     environment: pub-dev
     steps:
-      - uses: actions/checkout@v4
-      - uses: isoos/setup-dart@oidc-token
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
+      - uses: dart-lang/setup-dart@fedb1266e91cf51be2fdb382869461a434b920a3
       - name: Install dependencies
         run: dart pub get
       - name: Analyze

diff --git a/.github/workflows/test-package.yml b/.github/workflows/test-package.yml
@@ -12,6 +12,8 @@ on:
 env:
   PUB_ENVIRONMENT: bot.github
 
+permissions: read-all
+
 jobs:
   # Check code formatting and static analysis on a single OS (linux).
   analyze:
@@ -21,7 +23,7 @@ jobs:
       matrix:
         sdk: [3.2.0]
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: dart-lang/setup-dart@fedb1266e91cf51be2fdb382869461a434b920a3
         with:
           sdk: ${{ matrix.sdk }}
@@ -50,7 +52,7 @@ jobs:
         sdk: [3.2.0]
         flutter: [3.16.0]
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: dart-lang/setup-dart@fedb1266e91cf51be2fdb382869461a434b920a3
         with:
           sdk: ${{ matrix.sdk }}
@@ -79,11 +81,11 @@ jobs:
     strategy:
       fail-fast: false
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: dart-lang/setup-dart@fedb1266e91cf51be2fdb382869461a434b920a3
         with:
           sdk: '3.3.0-120.0.dev' # TODO: switch back to rolling 'dev' channel after it gets updated.
-      - uses: subosito/flutter-action@cc97e1648fff6ca5cc647fa67f47e70f7895510b
+      - uses: subosito/flutter-action@2783a3f08e1baf891508463f8c6653c258246225
         with:
           # flutter-version: '3.4.0-34.1.pre'
           channel: 'master' # TODO: switch back to rolling 'dev' channel after it gets updated.