[TheRealAgentK]

Overview

This PR strengthens dependency and release validation in GitHub Actions. It adds checks for vulnerable dependency changes, scans the committed Dart lockfile with OSV, tests both the stable and minimum supported Dart environments, validates the package before publication, and replaces the deprecated release asset uploader reported in #75.

Only GitHub Actions workflow files change. This PR does not modify application code, package dependencies, or pubspec.lock.

Dependency review policy

A new pull request workflow runs actions/dependency-review-action whenever a PR targets main.

• Fails when a dependency change introduces a vulnerability with moderate, high, or critical severity.
• Reviews both runtime and development dependencies.
• Disables license enforcement so the workflow remains focused on known vulnerabilities.
• Uses read-only repository contents permission.

This check evaluates the dependency changes introduced by the PR rather than rescanning only the resulting dependency graph.

OSV lockfile scanning

A separate OSV-Scanner workflow explicitly scans pubspec.lock.

Event	Scan behavior
Pull request or merge queue	Compares the proposed dependency graph with main by using OSV's PR workflow.
Push to main	Scans the complete lockfile after merge.
Weekly schedule	Runs a complete scan every Monday at 12:30 UTC so newly disclosed vulnerabilities are detected without a dependency change.
Manual dispatch	Allows a complete scan to be started from GitHub Actions.

The full scan is intentionally skipped during pull request events because the PR-specific scan handles that event. The workflow grants only the permissions required to read the repository and upload security results.

Dart and package validation

The primary CI job now selects the stable Dart SDK explicitly and runs dart pub publish --dry-run after formatting, analysis, and tests. This catches package metadata and archive-content problems before a release.

A new minimum-versions job validates the lower edge of the supported SDK and dependency ranges:

1. Installs Dart 3.11.0, the minimum declared by the package.
2. Runs dart pub downgrade to resolve minimum dependency versions.
3. Upgrades only the transitive frontend_server_client package.
4. Runs static analysis and the full test suite against that dependency graph.

The targeted frontend_server_client exception is required because the version selected by a full downgrade expects frontend_server.dart.snapshot, which Dart 3.11 no longer provides. Upgrading that one transitive package keeps the rest of the graph at its minimum versions while allowing the test runner to start.

Release upload hardening (#75)

Problem

The Linux, macOS, and Windows release jobs used AButler/[email protected]. GitHub now runs that Node.js 20 action under Node.js 24 and emits a deprecation warning in every release job.

Change

Each platform job now uploads its archive with the GitHub CLI that is already installed on GitHub-hosted runners:

gh release upload "${{ github.event.release.tag_name }}" <archive> --clobber

• GH_TOKEN uses the workflow-provided ${{ github.token }} value.
• The release workflow declares the required contents: write permission explicitly.
• --clobber makes a rerun replace an existing same-named asset instead of failing after a partial release.
• No replacement third-party upload action is introduced.
• The existing archive contract is unchanged: every platform ZIP still contains the executable, pubspec.lock, build-manifest.txt, and SHA256SUMS.

End-to-end test results

The upload path was tested with a temporary 2.0.4-alpha.0 GitHub prerelease at PR head commit c2be2ae89a05865e0b2ac6566f88bc831b7a6efe.

Release workflow run 37404773292 completed successfully:

• Linux, macOS, and Windows built their binaries and completed the new gh release upload step.
• The prerelease received all three expected assets:
  • raygun-cli-linux.zip
  • raygun-cli-macos.zip
  • raygun-cli-windows.zip
• Every archive's embedded SHA256SUMS validated the executable, pubspec.lock, and build-manifest.txt.
• Every build manifest recorded refs/tags/2.0.4-alpha.0 and the exact PR head commit.
• The Linux test binary reported version 2.0.3, as expected because the temporary prerelease tested delivery infrastructure without changing the package version.
• The complete workflow logs contained neither AButler/upload-release-assets nor the Node.js 20 deprecation warning.
• The temporary prerelease, tag, and downloaded verification artifacts were deleted after the checks passed.

Other verification

• All PR checks pass on Linux, macOS, and Windows.
• Dependency review passes with the moderate severity threshold enabled.
• The OSV pull request scan passes for pubspec.lock.
• Dart 3.11.0 analysis and all tests pass with the minimum-version dependency graph and the documented compiler-client exception.
• dart pub publish --dry-run completes with zero warnings.
• Workflow YAML parses successfully, and the gh release upload --clobber invocation is supported by the installed GitHub CLI.

Intentional policy choices

• Dependency license enforcement remains disabled.
• Vulnerability checks include development dependencies.
• Newly added action references use release version tags rather than immutable commit SHAs.
• Full OSV scans run after merge, on schedule, or by manual dispatch; PRs use the differential scan.

Closes #75

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[QuantumNightmare]

👍