ci: strengthen dependency security checks

.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+name: Dependency review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Review dependency changes
+        uses: actions/[email protected]
+        with:
+          fail-on-severity: moderate
+          fail-on-scopes: runtime, development
+          license-check: false

.github/workflows/main.yml

@@ -13,6 +13,8 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dart-lang/setup-dart@v1
+        with:
+          sdk: stable
 
       - name: Install dependencies
         run: dart pub get --enforce-lockfile
@@ -26,6 +28,30 @@ jobs:
       - name: Run tests
         run: dart test
 
+      - name: Validate package publishing
+        run: dart pub publish --dry-run
+
+  minimum-versions:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: dart-lang/setup-dart@v1
+        with:
+          sdk: 3.11.0
+
+      - name: Resolve minimum dependency versions
+        run: dart pub downgrade
+
+      - name: Use a Dart 3.11-compatible test compiler client
+        run: dart pub upgrade frontend_server_client
+
+      - name: Analyze project source
+        run: dart analyze
+
+      - name: Run tests
+        run: dart test
+
   build-linux:
     runs-on: ubuntu-latest
     steps:

.github/workflows/osv-scanner.yml

@@ -0,0 +1,32 @@
+name: OSV-Scanner
+
+on:
+  pull_request:
+    branches: [main]
+  merge_group:
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    - cron: '30 12 * * 1'
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  scan-pr:
+    if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
+    uses: google/osv-scanner-action/.github/workflows/[email protected]
+    with:
+      scan-args: |-
+        --lockfile=pubspec.lock
+
+  scan-full:
+    if: github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    uses: google/osv-scanner-action/.github/workflows/[email protected]
+    with:
+      scan-args: |-
+        --lockfile=pubspec.lock

.github/workflows/release.yml

@@ -4,6 +4,9 @@ on:
   release:
     types: [created]
 
+permissions:
+  contents: write
+
 jobs:
   build-linux:
     runs-on: ubuntu-latest
@@ -36,10 +39,10 @@ jobs:
       - name: Zip Linux binary
         run: zip raygun-cli-linux.zip raygun-cli pubspec.lock build-manifest.txt SHA256SUMS
 
-      - uses: AButler/upload-release[email protected]
-        with:
-          files: "raygun-cli-linux.zip"
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload Linux release asset
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "${{ github.event.release.tag_name }}" raygun-cli-linux.zip --clobber
 
   build-macos:
     runs-on: macos-latest
@@ -72,10 +75,10 @@ jobs:
       - name: Zip MacOS binary
         run: zip raygun-cli-macos.zip raygun-cli pubspec.lock build-manifest.txt SHA256SUMS
 
-      - uses: AButler/upload-release[email protected]
-        with:
-          files: "raygun-cli-macos.zip"
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload MacOS release asset
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "${{ github.event.release.tag_name }}" raygun-cli-macos.zip --clobber
 
   build-windows:
     runs-on: windows-latest
@@ -112,7 +115,7 @@ jobs:
       - name: Zip Windows binary
         run: 7z a -tzip raygun-cli-windows.zip raygun-cli.exe pubspec.lock build-manifest.txt SHA256SUMS
 
-      - uses: AButler/upload-release[email protected]
-        with:
-          files: "raygun-cli-windows.zip"
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload Windows release asset
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "${{ github.event.release.tag_name }}" raygun-cli-windows.zip --clobber