GitHub Action Workflows
Action workflows can be enabled by writing a yaml file inside .github/workflows folder of a given repository. These workflows run arbitrary code from GitHub repositories and with read/write permissions in the repository assets. This can be dangerous as anyone with write permissions to the repository can enable workflows using malicious code. To mitigate this only workflows with pinned commits within an allowed list can be executed.
Flutter repositories have workflows enabled with readonly ACLs by default. The ACLs can be overwritten providing specific permissions in the configuration file.
Determining whether a given workflow is secure or not goes well beyond flutter's capacity and it is the responsibility of the person enabling the workflow to diligently check the workflow for any potential security issues.
To add a new workflow please open a new bug using the ticket queue process. The following data points are required:
- Description/reason to enable this workflow
- workflow repository
- pinned commit
To update an existing workflow please open a new bug using the ticket queue process. The following data points are required:
- Description/reason to update the pinned version
- workflow/old_pinned_version
- workflow/new_pinned_version
flutter/engine please do not add any action workflows to this repository. The preferred way of building and testing is to use LUCI. This allows to plan for scalability, security and maintainability.
flutter/flutter the main use of workflows in this repo is to process bugs, projects, etc. Please do not use action workflows to build, run tests or release artifacts.
New workflow:
- Does it have an associated bug?
- Was the workflow/commit added to the allow list? Is the workflow pinned to a given commit?
- If the workflow require write access, is it overriding the ACLs explicitly?
- If the target repository has branch protection, is the configuration using secrets.FLUTTERGITHUBBOT_TOKEN instead of the default one?
- Is the workflow configured to not run on forks?
Update workflow:
- Does it have an associated bug?
- Was the workflow with old and new commits added to the allowed list?
- Home of the Wiki
- Roadmap
- API Reference (stable)
- API Reference (main)
- Glossary
- Contributor Guide
- Chat on Discord
- Design documents
- Code of Conduct
- Issue triage reports (latest)
- Our Values
- Tree hygiene
- Issue hygiene and Triage
- Style guide for Flutter repo
- Project teams
- Contributor access
- What should I work on?
- Popular issues
- Running and writing tests
- Release process
- Flutter Framework Gardener Rotation
- Rolling Dart
- Manual Engine Roll with Breaking Commits
- Updating Material Design Fonts & Icons
- Postmortems and Retrospectives
- Hotfix Documentation Best Practices
- In case of emergency
- Landing Changes With Autosubmit
- Setting up the Framework development environment
- The Framework architecture
- API Docs code block generation
- Running examples
- Using the Dart analyzer
- The flutter run variants
- Test coverage for package:flutter
- Writing a golden-file test for package:flutter
- Managing template image assets
- Setting up the Engine development environment
- Compiling the engine
- Debugging the engine
- Using Sanitizers with the Flutter Engine
- Testing the engine
- The Engine architecture
- Flutter's modes
- Crashes
- more...
- Setting up the Packages development environment
- Plugins and Packages repository structure
- Contributing to Plugins and Packages
- Understanding Packages tests
- Plugin Tests
- Releasing a Plugin or Package
- more...