chore: harden GitHub Actions workflows against Zizmor findings - #1971
Open
kevmoo wants to merge 2 commits into
Open
chore: harden GitHub Actions workflows against Zizmor findings#1971kevmoo wants to merge 2 commits into
kevmoo wants to merge 2 commits into
Conversation
kevmoo
commented
Aug 11, 2026
kevmoo
commented
Member
- Pin dart-lang/ecosystem workflows to full commit SHA
- Add top-level permissions: contents: read where missing
- Set persist-credentials: false on actions/checkout steps
- Add cooldown to dependabot configuration
- Ignore dangerous-triggers for post_summaries workflow_run
- Pin dart-lang/ecosystem workflows to full commit SHA - Add top-level permissions: contents: read where missing - Set persist-credentials: false on actions/checkout steps - Add cooldown to dependabot configuration - Ignore dangerous-triggers for post_summaries workflow_run
github-actions
Bot
added
the
type-infra
PR Health
License Headers
|
| Files |
|---|
| pkgs/cupertino_http/example/example.dart |
| pkgs/http/example/main.dart |
| pkgs/http_multi_server/test/cert.dart |
All source files should start with a license header.
This check can be disabled by tagging the PR with skip-license-check.
Unused Dependencies ⚠️
| Package | Status |
|---|---|
| cronet_http | ❗ Show IssuesThese packages are used outside lib/ but are not dev_dependencies: |
| cupertino_http | ❗ Show IssuesThese packages are used outside lib/ but are not dev_dependencies: |
| http | ❗ Show IssuesThese packages may be unused, or you may be using assets from these packages: |
| http2 | ✔️ All dependencies utilized correctly. |
| http_multi_server | ✔️ All dependencies utilized correctly. |
| http_parser | ✔️ All dependencies utilized correctly. |
| http_profile | ❗ Show IssuesThese packages may be unused, or you may be using assets from these packages: |
| ok_http | ❗ Show IssuesThese packages are used outside lib/ but are not dev_dependencies: |
| web_socket | ❗ Show IssuesThese packages may be unused, or you may be using assets from these packages: |
| web_socket_channel | ✔️ All dependencies utilized correctly. |
For details on how to fix these, see dependency_validator.
This check can be disabled by tagging the PR with skip-unused-dependencies-check.
Coverage ⚠️
| File | Coverage |
|---|---|
| pkgs/cronet_http/example/integration_test/client_profile_test.dart | 💔 Not covered |
| pkgs/cronet_http/example/integration_test/client_test.dart | 💔 Not covered |
| pkgs/cronet_http/example/integration_test/cronet_engine_test.dart | 💔 Not covered |
| pkgs/cronet_http/example/lib/book.dart | 💔 Not covered |
| pkgs/cronet_http/example/lib/main.dart | 💔 Not covered |
| pkgs/cronet_http/lib/cronet_http.dart | 💔 Not covered |
| pkgs/cronet_http/lib/src/cronet_client.dart | 💔 Not covered |
| pkgs/cronet_http/lib/src/jni/jni_bindings.dart | 💔 Not covered |
| pkgs/cupertino_http/example/example.dart | 💔 Not covered |
| pkgs/cupertino_http/hook/build.dart | 💔 Not covered |
| pkgs/cupertino_http/ios_test/integration_test/combined_test.dart | 💔 Not covered |
| pkgs/cupertino_http/ios_test/lib/main.dart | 💔 Not covered |
| pkgs/cupertino_http/lib/cupertino_http.dart | 💔 Not covered |
| pkgs/cupertino_http/lib/src/cupertino_api.dart | 💚 4 % |
| pkgs/cupertino_http/lib/src/cupertino_client.dart | 💚 1 % |
| pkgs/cupertino_http/lib/src/cupertino_web_socket.dart | 💔 0 % ⬇️ NaN % |
| pkgs/cupertino_http/lib/src/native_cupertino_bindings.dart | 💚 0 % |
| pkgs/http/example/main.dart | 💔 Not covered |
| pkgs/http/example/retry.dart | 💔 Not covered |
| pkgs/http/lib/browser_client.dart | 💔 Not covered |
| pkgs/http/lib/http.dart | 💚 100 % |
| pkgs/http/lib/io_client.dart | 💔 Not covered |
| pkgs/http/lib/retry.dart | 💚 93 % |
| pkgs/http/lib/src/abortable.dart | 💚 100 % |
| pkgs/http/lib/src/base_client.dart | 💚 97 % |
| pkgs/http/lib/src/base_request.dart | 💚 88 % |
| pkgs/http/lib/src/base_response.dart | 💚 87 % |
| pkgs/http/lib/src/boundary_characters.dart | 💔 Not covered |
| pkgs/http/lib/src/browser_client.dart | 💔 Not covered |
| pkgs/http/lib/src/byte_stream.dart | 💚 87 % |
| pkgs/http/lib/src/client.dart | 💚 100 % |
| pkgs/http/lib/src/client_stub.dart | 💔 Not covered |
| pkgs/http/lib/src/exception.dart | 💚 20 % |
| pkgs/http/lib/src/io_client.dart | 💚 89 % |
| pkgs/http/lib/src/io_streamed_response.dart | 💚 100 % |
| pkgs/http/lib/src/mock_client.dart | 💚 100 % |
| pkgs/http/lib/src/multipart_file.dart | 💚 95 % |
| pkgs/http/lib/src/multipart_file_io.dart | 💚 100 % |
| pkgs/http/lib/src/multipart_file_stub.dart | 💔 Not covered |
| pkgs/http/lib/src/multipart_request.dart | 💚 93 % |
| pkgs/http/lib/src/request.dart | 💚 98 % |
| pkgs/http/lib/src/response.dart | 💚 100 % |
| pkgs/http/lib/src/streamed_request.dart | 💚 100 % |
| pkgs/http/lib/src/streamed_response.dart | 💚 100 % |
| pkgs/http/lib/src/utils.dart | 💚 96 % |
| pkgs/http/lib/testing.dart | 💔 Not covered |
| pkgs/http2/example/display_headers.dart | 💔 Not covered |
| pkgs/http2/lib/http2.dart | 💔 Not covered |
| pkgs/http2/lib/multiprotocol_server.dart | 💚 90 % |
| pkgs/http2/lib/src/artificial_server_socket.dart | 💚 50 % |
| pkgs/http2/lib/src/async_utils/async_utils.dart | 💚 100 % |
| pkgs/http2/lib/src/byte_utils.dart | 💚 100 % |
| pkgs/http2/lib/src/connection.dart | 💚 83 % |
| pkgs/http2/lib/src/connection_preface.dart | 💚 100 % |
| pkgs/http2/lib/src/error_handler.dart | 💚 98 % |
| pkgs/http2/lib/src/flowcontrol/connection_queues.dart | 💚 93 % |
| pkgs/http2/lib/src/flowcontrol/queue_messages.dart | 💚 42 % |
| pkgs/http2/lib/src/flowcontrol/stream_queues.dart | 💚 88 % |
| pkgs/http2/lib/src/flowcontrol/window.dart | 💚 100 % |
| pkgs/http2/lib/src/flowcontrol/window_handler.dart | 💚 100 % |
| pkgs/http2/lib/src/frames/frame_defragmenter.dart | 💚 100 % |
| pkgs/http2/lib/src/frames/frame_reader.dart | 💚 90 % |
| pkgs/http2/lib/src/frames/frame_types.dart | 💚 57 % |
| pkgs/http2/lib/src/frames/frame_utils.dart | 💚 100 % |
| pkgs/http2/lib/src/frames/frame_writer.dart | 💚 86 % |
| pkgs/http2/lib/src/frames/frames.dart | 💔 Not covered |
| pkgs/http2/lib/src/hpack/hpack.dart | 💚 95 % |
| pkgs/http2/lib/src/hpack/huffman.dart | 💚 95 % |
| pkgs/http2/lib/src/hpack/huffman_table.dart | 💚 100 % |
| pkgs/http2/lib/src/ping/ping_handler.dart | 💚 100 % |
| pkgs/http2/lib/src/settings/settings.dart | 💚 94 % |
| pkgs/http2/lib/src/streams/stream_handler.dart | 💚 91 % |
| pkgs/http2/lib/src/sync_errors.dart | 💚 81 % |
| pkgs/http2/lib/transport.dart | 💚 82 % |
| pkgs/http2/manual_test/out_of_stream_ids_test.dart | 💔 Not covered |
| pkgs/http_multi_server/example/main.dart | 💔 Not covered |
| pkgs/http_multi_server/lib/http_multi_server.dart | 💚 65 % |
| pkgs/http_multi_server/lib/src/multi_headers.dart | 💚 6 % |
| pkgs/http_multi_server/lib/src/utils.dart | 💚 80 % |
| pkgs/http_parser/example/example.dart | 💔 Not covered |
| pkgs/http_parser/lib/http_parser.dart | 💔 Not covered |
| pkgs/http_parser/lib/src/authentication_challenge.dart | 💚 100 % |
| pkgs/http_parser/lib/src/case_insensitive_map.dart | 💚 100 % |
| pkgs/http_parser/lib/src/chunked_coding.dart | 💚 100 % |
| pkgs/http_parser/lib/src/chunked_coding/charcodes.dart | 💔 Not covered |
| pkgs/http_parser/lib/src/chunked_coding/decoder.dart | 💚 94 % |
| pkgs/http_parser/lib/src/chunked_coding/encoder.dart | 💚 100 % |
| pkgs/http_parser/lib/src/http_date.dart | 💚 100 % |
| pkgs/http_parser/lib/src/media_type.dart | 💚 98 % |
| pkgs/http_parser/lib/src/scan.dart | 💚 100 % |
| pkgs/http_parser/lib/src/utils.dart | 💚 100 % |
| pkgs/http_profile/lib/http_profile.dart | 💔 Not covered |
| pkgs/http_profile/lib/src/http_client_request_profile.dart | 💚 98 % |
| pkgs/http_profile/lib/src/http_profile.dart | 💔 Not covered |
| pkgs/http_profile/lib/src/http_profile_request_data.dart | 💚 100 % |
| pkgs/http_profile/lib/src/http_profile_response_data.dart | 💚 96 % |
| pkgs/http_profile/lib/src/utils.dart | 💚 100 % |
| pkgs/ok_http/example/integration_test/certificate_test.dart | 💔 Not covered |
| pkgs/ok_http/example/integration_test/client_configuration_test.dart | 💔 Not covered |
| pkgs/ok_http/example/integration_test/client_profile_test.dart | 💔 Not covered |
| pkgs/ok_http/example/integration_test/client_test.dart | 💔 Not covered |
| pkgs/ok_http/example/integration_test/web_socket_test.dart | 💔 Not covered |
| pkgs/ok_http/example/lib/book.dart | 💔 Not covered |
| pkgs/ok_http/example/lib/main.dart | 💔 Not covered |
| pkgs/ok_http/lib/ok_http.dart | 💔 Not covered |
| pkgs/ok_http/lib/src/jni/bindings.dart | 💔 Not covered |
| pkgs/ok_http/lib/src/ok_http_client.dart | 💔 Not covered |
| pkgs/ok_http/lib/src/ok_http_web_socket.dart | 💔 Not covered |
| pkgs/web_socket/example/web_socket_example.dart | 💔 Not covered |
| pkgs/web_socket/lib/browser_web_socket.dart | 💔 Not covered |
| pkgs/web_socket/lib/io_web_socket.dart | 💔 Not covered |
| pkgs/web_socket/lib/src/browser_web_socket.dart | 💔 Not covered |
| pkgs/web_socket/lib/src/connect_stub.dart | 💔 Not covered |
| pkgs/web_socket/lib/src/fake_web_socket.dart | 💚 100 % |
| pkgs/web_socket/lib/src/io_web_socket.dart | 💚 85 % |
| pkgs/web_socket/lib/src/utils.dart | 💚 100 % |
| pkgs/web_socket/lib/src/web_socket.dart | 💚 68 % |
| pkgs/web_socket/lib/testing.dart | 💔 Not covered |
| pkgs/web_socket/lib/web_socket.dart | 💔 Not covered |
| pkgs/web_socket_channel/example/example.dart | 💔 Not covered |
| pkgs/web_socket_channel/lib/adapter_web_socket_channel.dart | 💚 96 % |
| pkgs/web_socket_channel/lib/html.dart | 💔 Not covered |
| pkgs/web_socket_channel/lib/io.dart | 💚 100 % |
| pkgs/web_socket_channel/lib/src/channel.dart | 💚 50 % |
| pkgs/web_socket_channel/lib/src/exception.dart | 💚 20 % |
| pkgs/web_socket_channel/lib/src/sink_completer.dart | 💔 Not covered |
| pkgs/web_socket_channel/lib/status.dart | 💔 Not covered |
| pkgs/web_socket_channel/lib/web_socket_channel.dart | 💔 Not covered |
This check for test coverage is informational (issues shown here will not fail the PR).
This check can be disabled by tagging the PR with skip-coverage-check.
Changelog Entry ✔️
| Package | Changed Files |
|---|
Changes to files need to be accounted for in their respective changelogs.
This check can be disabled by tagging the PR with skip-changelog-check.
API leaks ⚠️
The following packages contain symbols visible in the public API, but not exported by the library. Export these symbols or remove them from your publicly visible API.
| Package | Leaked API symbol | Leaking sources |
|---|---|---|
| http | RequestCredentials | browser_client.dart::BrowserClient::new::requestCredentials browser_client.dart::RequestCredentials::omit browser_client.dart::RequestCredentials::sameOrigin browser_client.dart::RequestCredentials::include browser_client.dart::RequestCredentials::values |
| ok_http | $Call$Factory | jni/bindings.dart::Call$Factory::implementIn::$impl jni/bindings.dart::Call$Factory::implement::$impl |
| ok_http | $Call | jni/bindings.dart::Call::implementIn::$impl jni/bindings.dart::Call::implement::$impl |
| ok_http | $Callback | jni/bindings.dart::Callback::implementIn::$impl jni/bindings.dart::Callback::implement::$impl |
| ok_http | $ExecutorService | jni/bindings.dart::ExecutorService::implementIn::$impl jni/bindings.dart::ExecutorService::implement::$impl |
| ok_http | $RedirectReceivedCallback | jni/bindings.dart::RedirectReceivedCallback::implementIn::$impl jni/bindings.dart::RedirectReceivedCallback::implement::$impl |
| ok_http | $DataCallback | jni/bindings.dart::DataCallback::implementIn::$impl jni/bindings.dart::DataCallback::implement::$impl |
| ok_http | $WebSocket$Factory | jni/bindings.dart::WebSocket$Factory::implementIn::$impl jni/bindings.dart::WebSocket$Factory::implement::$impl |
| ok_http | $WebSocket | jni/bindings.dart::WebSocket::implementIn::$impl jni/bindings.dart::WebSocket::implement::$impl |
| ok_http | $WebSocketListenerProxy$WebSocketListener | jni/bindings.dart::WebSocketListenerProxy$WebSocketListener::implementIn::$impl jni/bindings.dart::WebSocketListenerProxy$WebSocketListener::implement::$impl |
| ok_http | $PrivateKey | jni/bindings.dart::PrivateKey::implementIn::$impl jni/bindings.dart::PrivateKey::implement::$impl |
| ok_http | $X509TrustManager | jni/bindings.dart::X509TrustManager::implementIn::$impl jni/bindings.dart::X509TrustManager::implement::$impl |
| ok_http | $TrustManager | jni/bindings.dart::TrustManager::implementIn::$impl jni/bindings.dart::TrustManager::implement::$impl |
| ok_http | $KeyStore$ProtectionParameter | jni/bindings.dart::KeyStore$ProtectionParameter::implementIn::$impl jni/bindings.dart::KeyStore$ProtectionParameter::implement::$impl |
| ok_http | $KeyStore$LoadStoreParameter | jni/bindings.dart::KeyStore$LoadStoreParameter::implementIn::$impl jni/bindings.dart::KeyStore$LoadStoreParameter::implement::$impl |
| ok_http | $KeyStore$Entry$Attribute | jni/bindings.dart::KeyStore$Entry$Attribute::implementIn::$impl jni/bindings.dart::KeyStore$Entry$Attribute::implement::$impl |
| ok_http | $KeyStore$Entry | jni/bindings.dart::KeyStore$Entry::implementIn::$impl jni/bindings.dart::KeyStore$Entry::implement::$impl |
| ok_http | $KeyManager | jni/bindings.dart::KeyManager::implementIn::$impl jni/bindings.dart::KeyManager::implement::$impl |
| ok_http | $X509KeyManager | jni/bindings.dart::X509KeyManager::implementIn::$impl jni/bindings.dart::X509KeyManager::implement::$impl |
| ok_http | $HostnameVerifier | jni/bindings.dart::HostnameVerifier::implementIn::$impl jni/bindings.dart::HostnameVerifier::implement::$impl |
| ok_http | $KeyChainAliasCallback | jni/bindings.dart::KeyChainAliasCallback::implementIn::$impl jni/bindings.dart::KeyChainAliasCallback::implement::$impl |
| ok_http | $Key | jni/bindings.dart::Key::implementIn::$impl jni/bindings.dart::Key::implement::$impl |
| ok_http | $PublicKey | jni/bindings.dart::PublicKey::implementIn::$impl jni/bindings.dart::PublicKey::implement::$impl |
| ok_http | $Enumeration | jni/bindings.dart::Enumeration::implementIn::$impl jni/bindings.dart::Enumeration::implement::$impl |
This check can be disabled by tagging the PR with skip-leaking-check.
Breaking changes ✔️
| Package | Change | Current Version | New Version | Needed Version | Looking good? |
|---|---|---|---|---|---|
| web_socket | None | 1.0.1 | 1.0.1 | 1.0.1 | ✔️ |
| http_multi_server | None | 3.2.2 | 3.2.2 | 3.2.2 | ✔️ |
| http_profile | None | 0.1.0 | 0.1.1-wip | 0.1.1-wip | ✔️ |
| web_socket_channel | None | 3.0.3 | 3.0.4-wip | 3.0.4-wip | ✔️ |
| http2 | Non-Breaking | 2.3.1 | 3.0.1-wip | 3.0.1-wip | ✔️ |
| http_parser | None | 4.1.2 | 4.1.3-wip | 4.1.3-wip | ✔️ |
| http | Non-Breaking | 1.6.0 | 1.7.0-wip | 1.7.0-wip | ✔️ |
| cronet_http | Non-Breaking | 1.9.0 | 1.10.0-wip | 1.10.0-wip | ✔️ |
| cupertino_http | None | 3.0.2 | 3.0.2 | 3.0.2 | ✔️ |
| ok_http | Non-Breaking | 0.1.0 | 0.1.1-wip | 0.1.1-wip | ✔️ |
This check can be disabled by tagging the PR with skip-breaking-check.
natebosch
approved these changes
Aug 11, 2026
Member
Author
|
@brianquinlan - what do you think? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.