From 472aca2b01f2b91dde3615eb5376537685e5a3fe Mon Sep 17 00:00:00 2001 From: Ankit Mahato Date: Fri, 26 Sep 2025 05:21:05 +0530 Subject: [PATCH 1/7] Run scorecard on 1st of each month The scorecard workflow. --- .github/workflows/scorecard.yml | 78 +++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 00000000..cc9679e5 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,78 @@ +# This workflow uses actions that are not certified by GitHub. They are provided +# by a third-party and are governed by separate terms of service, privacy +# policy, and support documentation. + +name: Scorecard supply-chain security +on: + # For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection + branch_protection_rule: + # To guarantee Maintained check is occasionally updated. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained + schedule: + - cron: '30 5 1 * *' + push: + branches: [ "main" ] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled. + if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request' + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Needed to publish results and get a badge (see publish_results below). + id-token: write + # Uncomment the permissions below if installing in a private repository. + # contents: read + # actions: read + + steps: + - name: "Checkout code" + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1 + with: + results_file: results.sarif + results_format: sarif + # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: + # - you want to enable the Branch-Protection check on a *public* repository, or + # - you are installing Scorecard on a *private* repository + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional. + # repo_token: ${{ secrets.SCORECARD_TOKEN }} + + # Public repositories: + # - Publish results to OpenSSF REST API for easy access by consumers + # - Allows the repository to include the Scorecard badge. + # - See https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories: + # - `publish_results` will always be set to `false`, regardless + # of the value entered here. + publish_results: true + + # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore + # file_mode: git + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard (optional). + # Commenting out will disable upload of results to your repo's Code Scanning dashboard + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: results.sarif From 2c6e80535eefe1c93b11300245aec1e24306de8f Mon Sep 17 00:00:00 2001 From: Ankit Mahato Date: Fri, 26 Sep 2025 05:28:59 +0530 Subject: [PATCH 2/7] Potential fix for code scanning alert no. 1: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .github/workflows/aur-publish.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml index 2d11aed4..80b30ce4 100644 --- a/.github/workflows/aur-publish.yml +++ b/.github/workflows/aur-publish.yml @@ -1,4 +1,6 @@ name: Update AUR Package +permissions: + contents: read on: push: From 9db482a422dd5b28af481fdbd4afe6c8313cdff6 Mon Sep 17 00:00:00 2001 From: Ankit Mahato Date: Fri, 26 Sep 2025 06:02:51 +0530 Subject: [PATCH 3/7] Modify Dependabot settings for Dart packages Updated Dependabot configuration to support Dart packages and changed update schedule to monthly. --- .github/dependabot.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..e1c2c542 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,13 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file + +version: 2 +updates: + - package-ecosystem: "pub" # See documentation for possible values + directories: + - "/" # Location of package manifests + - "/packages/*/ + schedule: + interval: "monthly" From 2d6a7e32ac1a827807a448ff2bdfba112ab87044 Mon Sep 17 00:00:00 2001 From: Ankit Mahato Date: Fri, 26 Sep 2025 06:05:21 +0530 Subject: [PATCH 4/7] Fix directory path format in dependabot config --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e1c2c542..b2cd4c58 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,6 +8,6 @@ updates: - package-ecosystem: "pub" # See documentation for possible values directories: - "/" # Location of package manifests - - "/packages/*/ + - "/packages/*/" schedule: interval: "monthly" From f4b01d3ddb7b8fd6194b7af3197b00cdec587bfc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 26 Sep 2025 00:38:17 +0000 Subject: [PATCH 5/7] Bump flutter_lints from 4.0.0 to 6.0.0 in /packages/apidash_core Bumps [flutter_lints](https://github.com/flutter/packages/tree/main/packages) from 4.0.0 to 6.0.0. - [Commits](https://github.com/flutter/packages/commits/flutter_lints-v6.0.0/packages) --- updated-dependencies: - dependency-name: flutter_lints dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- packages/apidash_core/pubspec.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/apidash_core/pubspec.yaml b/packages/apidash_core/pubspec.yaml index c340f8af..c3c78323 100644 --- a/packages/apidash_core/pubspec.yaml +++ b/packages/apidash_core/pubspec.yaml @@ -28,7 +28,7 @@ dev_dependencies: flutter_test: sdk: flutter build_runner: ^2.4.12 - flutter_lints: ^4.0.0 + flutter_lints: ^6.0.0 freezed: ^2.5.7 json_serializable: ^6.7.1 test: ^1.25.2 From 2a70c0a2f6f9b4f693ef1dd3c8a2837d596964eb Mon Sep 17 00:00:00 2001 From: Ankit Mahato Date: Sat, 27 Sep 2025 15:15:24 +0530 Subject: [PATCH 6/7] Update checkout action to specific commit Updated actions/checkout to a specific commit hash. --- .github/workflows/aur-publish.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml index 80b30ce4..1bd36186 100644 --- a/.github/workflows/aur-publish.yml +++ b/.github/workflows/aur-publish.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Get version from pubspec id: get_version @@ -87,4 +87,4 @@ jobs: commit_username: ${{ secrets.AUR_USERNAME }} commit_email: ${{ secrets.AUR_EMAIL }} ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }} - commit_message: "Update to version ${{ steps.get_version.outputs.version }}" \ No newline at end of file + commit_message: "Update to version ${{ steps.get_version.outputs.version }}" From 66c78ad0a47c60b97f55e1f66c8550f031884db0 Mon Sep 17 00:00:00 2001 From: Ankit Mahato Date: Sat, 27 Sep 2025 15:19:19 +0530 Subject: [PATCH 7/7] Update AUR deployment action version --- .github/workflows/aur-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml index 1bd36186..10d9108e 100644 --- a/.github/workflows/aur-publish.yml +++ b/.github/workflows/aur-publish.yml @@ -44,7 +44,7 @@ jobs: echo "license_checksum=$LICENSE_CHECKSUM" >> $GITHUB_OUTPUT - name: Publish AUR package - uses: KSXGitHub/github-actions-deploy-aur@v2.7.0 + uses: KSXGitHub/github-actions-deploy-aur@2ac5a4c1d7035885d46b10e3193393be8460b6f1 # v4.1.1 with: pkgname: apidash-bin pkgbuild: |