From 1462ee1fe0d22d67bb0f1e856bb275125c8e3477 Mon Sep 17 00:00:00 2001 From: Kai Koenig Date: Tue, 6 Oct 2026 13:34:39 +1300 Subject: [PATCH 1/4] ci: add dependency review --- .github/workflows/dependency-review.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..c3edec8 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,22 @@ +name: Dependency review + +on: + pull_request: + branches: [main] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v7 + + - name: Review dependency changes + uses: actions/dependency-review-action@v5.0.0 + with: + fail-on-severity: moderate + fail-on-scopes: runtime, development + license-check: false From a666b3db80027b2dab5652ec4391a0e8fe2b13c5 Mon Sep 17 00:00:00 2001 From: Kai Koenig Date: Tue, 6 Oct 2026 13:48:00 +1300 Subject: [PATCH 2/4] ci: strengthen dependency validation --- .github/workflows/main.yml | 23 ++++++++++++++++++++++ .github/workflows/osv-scanner.yml | 32 +++++++++++++++++++++++++++++++ 2 files changed, 55 insertions(+) create mode 100644 .github/workflows/osv-scanner.yml diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index c506d35..ac42d3e 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -13,6 +13,8 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dart-lang/setup-dart@v1 + with: + sdk: stable - name: Install dependencies run: dart pub get --enforce-lockfile @@ -26,6 +28,27 @@ jobs: - name: Run tests run: dart test + - name: Validate package publishing + run: dart pub publish --dry-run + + minimum-versions: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - uses: dart-lang/setup-dart@v1 + with: + sdk: 3.11.0 + + - name: Resolve minimum dependency versions + run: dart pub downgrade + + - name: Analyze project source + run: dart analyze + + - name: Run tests + run: dart test + build-linux: runs-on: ubuntu-latest steps: diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml new file mode 100644 index 0000000..18e5a08 --- /dev/null +++ b/.github/workflows/osv-scanner.yml @@ -0,0 +1,32 @@ +name: OSV-Scanner + +on: + pull_request: + branches: [main] + merge_group: + branches: [main] + push: + branches: [main] + schedule: + - cron: '30 12 * * 1' + workflow_dispatch: + +permissions: + actions: read + contents: read + security-events: write + +jobs: + scan-pr: + if: github.event_name == 'pull_request' || github.event_name == 'merge_group' + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.6.0 + with: + scan-args: |- + --lockfile=pubspec.lock + + scan-full: + if: github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.6.0 + with: + scan-args: |- + --lockfile=pubspec.lock From 013fc967ecc9a466bdffbdf6473ab19f7ddaa12c Mon Sep 17 00:00:00 2001 From: Kai Koenig Date: Tue, 6 Oct 2026 13:53:57 +1300 Subject: [PATCH 3/4] ci: handle test runner lower-bound mismatch --- .github/workflows/main.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index ac42d3e..0fc7d95 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -43,6 +43,9 @@ jobs: - name: Resolve minimum dependency versions run: dart pub downgrade + - name: Use a Dart 3.11-compatible test compiler client + run: dart pub upgrade frontend_server_client + - name: Analyze project source run: dart analyze From c2be2ae89a05865e0b2ac6566f88bc831b7a6efe Mon Sep 17 00:00:00 2001 From: Kai Koenig Date: Tue, 6 Oct 2026 14:39:50 +1300 Subject: [PATCH 4/4] ci: replace deprecated release uploader --- .github/workflows/release.yml | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 461c62c..ce3a913 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,6 +4,9 @@ on: release: types: [created] +permissions: + contents: write + jobs: build-linux: runs-on: ubuntu-latest @@ -36,10 +39,10 @@ jobs: - name: Zip Linux binary run: zip raygun-cli-linux.zip raygun-cli pubspec.lock build-manifest.txt SHA256SUMS - - uses: AButler/upload-release-assets@v3.0 - with: - files: "raygun-cli-linux.zip" - repo-token: ${{ secrets.GITHUB_TOKEN }} + - name: Upload Linux release asset + env: + GH_TOKEN: ${{ github.token }} + run: gh release upload "${{ github.event.release.tag_name }}" raygun-cli-linux.zip --clobber build-macos: runs-on: macos-latest @@ -72,10 +75,10 @@ jobs: - name: Zip MacOS binary run: zip raygun-cli-macos.zip raygun-cli pubspec.lock build-manifest.txt SHA256SUMS - - uses: AButler/upload-release-assets@v3.0 - with: - files: "raygun-cli-macos.zip" - repo-token: ${{ secrets.GITHUB_TOKEN }} + - name: Upload MacOS release asset + env: + GH_TOKEN: ${{ github.token }} + run: gh release upload "${{ github.event.release.tag_name }}" raygun-cli-macos.zip --clobber build-windows: runs-on: windows-latest @@ -112,7 +115,7 @@ jobs: - name: Zip Windows binary run: 7z a -tzip raygun-cli-windows.zip raygun-cli.exe pubspec.lock build-manifest.txt SHA256SUMS - - uses: AButler/upload-release-assets@v3.0 - with: - files: "raygun-cli-windows.zip" - repo-token: ${{ secrets.GITHUB_TOKEN }} + - name: Upload Windows release asset + env: + GH_TOKEN: ${{ github.token }} + run: gh release upload "${{ github.event.release.tag_name }}" raygun-cli-windows.zip --clobber