ci: scope GITHUB_TOKEN to least privilege in release workflow (#757) #1290
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| pull_request: | |
| types: [opened, synchronize] | |
| push: | |
| branches: | |
| - 'main' | |
| jobs: | |
| build: | |
| name: Run on ${{ matrix.os }} | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: wasabeef/import-asdf-tool-versions-action@v1.0.3 | |
| id: asdf | |
| - uses: subosito/flutter-action@v2 | |
| with: | |
| flutter-version: ${{ steps.asdf.outputs.flutter }} | |
| channel: stable | |
| cache: true | |
| - name: Set environment for MacOS & Ubuntu | |
| if: startsWith(matrix.os, 'macos') || startsWith(matrix.os, 'ubuntu') | |
| run: echo "$HOME/.pub-cache/bin" >> $GITHUB_PATH | |
| - name: Set environment for Windows | |
| if: startsWith(matrix.os, 'windows') | |
| run: echo "%LOCALAPPDATA%\Pub\Cache\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append | |
| - name: Prepare workspace | |
| uses: bluefireteam/melos-action@v3 | |
| - name: Generate test data and see if changes | |
| run: | | |
| melos gen:actual_data | |
| git --no-pager diff --exit-code packages/core/test_resources/actual_data | |
| - name: Run tests for Dart packages | |
| if: startsWith(matrix.os, 'ubuntu') | |
| run: melos test:dart --no-select | |
| - name: Run tests for Flutter packages | |
| if: startsWith(matrix.os, 'ubuntu') | |
| run: melos test:flutter --no-select | |
| - name: Run coverage | |
| if: startsWith(matrix.os, 'ubuntu') | |
| run: melos coverage | |
| - uses: codecov/codecov-action@v5 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: ./packages/core/coverage.lcov | |
| - name: Generate example then check formats and changes | |
| run: | # Run format and diff for each gen step. | |
| melos run gen:examples:command --no-select | |
| dart format --set-exit-if-changed examples | |
| git --no-pager diff --exit-code examples | |
| melos run gen:examples:build_runner --no-select | |
| dart format --set-exit-if-changed examples | |
| git --no-pager diff --exit-code examples | |
| melos run gen:examples:workspace:command --no-select | |
| dart format --set-exit-if-changed examples | |
| git --no-pager diff --exit-code examples | |
| melos run gen:examples:workspace:build_runner --no-select | |
| dart format --set-exit-if-changed examples | |
| git --no-pager diff --exit-code examples | |
| - name: Statically analyze the code | |
| run: melos analyze |