diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..cebecdc --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,25 @@ +version: 2 + +# Scoped to GitHub Actions on purpose. +# +# The `pub` ecosystem is deliberately left out: several dependencies here are +# pinned or overridden for reasons Dependabot can't see — file_picker is held +# at 10.x by appflowy_editor's API (issue #2), `intl` and +# `path_provider_foundation` are dependency_overrides, and the whole tree is +# constrained by the Flutter 3.41.9 pin in .fvmrc. Version-bump PRs against +# those would be noise that has to be closed by hand. Dependabot *security* +# alerts still cover pub packages; this file only controls version updates. +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + commit-message: + prefix: ci + # One PR for the routine bumps; a major version gets its own PR, since + # those carry the runtime/behaviour changes worth reviewing alone. + groups: + actions-minor: + update-types: + - minor + - patch diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a8dd951..2cc186f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,7 +18,7 @@ jobs: name: Analyze & test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: subosito/flutter-action@v2 with: flutter-version: ${{ env.FLUTTER_VERSION }} @@ -33,8 +33,8 @@ jobs: needs: analyze-test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-java@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-java@v6 with: distribution: temurin java-version: "17" @@ -46,7 +46,7 @@ jobs: - run: flutter pub get - run: flutter build apk --release - run: flutter build appbundle --release - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: android path: | @@ -58,7 +58,7 @@ jobs: needs: analyze-test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install Linux build deps run: | sudo apt-get update @@ -70,7 +70,7 @@ jobs: cache: true - run: flutter pub get - run: flutter build linux --release - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: linux path: build/linux/x64/release/bundle/ @@ -80,7 +80,7 @@ jobs: needs: analyze-test runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: subosito/flutter-action@v2 with: flutter-version: ${{ env.FLUTTER_VERSION }} @@ -88,7 +88,7 @@ jobs: cache: true - run: flutter pub get - run: flutter build windows --release - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: windows path: build/windows/x64/runner/Release/ @@ -98,7 +98,7 @@ jobs: needs: analyze-test runs-on: macos-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: subosito/flutter-action@v2 with: flutter-version: ${{ env.FLUTTER_VERSION }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f5f9d60..a870e88 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,8 +39,8 @@ jobs: # and lose data). HAS_KEYSTORE: ${{ secrets.ANDROID_KEYSTORE_BASE64 != '' }} steps: - - uses: actions/checkout@v4 - - uses: actions/setup-java@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-java@v6 with: distribution: temurin java-version: "17" @@ -85,7 +85,7 @@ jobs: echo "::notice::ANDROID_KEYSTORE_* secrets not configured — Android artifacts skipped (a per-run debug key would change the signing certificate every release and break in-place updates)." - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 if: env.HAS_KEYSTORE == 'true' with: name: release-android @@ -99,7 +99,7 @@ jobs: # desktops. runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Compute package version # Dispatch dry-runs come from branches (no semver): package as 0.0.0. run: | @@ -166,7 +166,7 @@ jobs: sed -i 's/^ //' "$PKG/DEBIAN/control" dpkg-deb --build --root-owner-group "$PKG" \ "dist/markdown-studio-linux-amd64.deb" - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: release-linux path: dist/ @@ -179,7 +179,7 @@ jobs: # exist; secrets can't be used in step `if:` directly. HAS_STORE_IDENTITY: ${{ secrets.MSIX_IDENTITY_NAME != '' && secrets.MSIX_PUBLISHER != '' && secrets.MSIX_PUBLISHER_DISPLAY_NAME != '' }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Compute package version shell: pwsh run: | @@ -280,7 +280,7 @@ jobs: --publisher-display-name $env:MSIX_PUBLISHER_DISPLAY_NAME Copy-Item build/windows/x64/runner/Release/markdown_studio.msix ` dist/markdown-studio-windows-store.msix - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: release-windows path: dist/ @@ -289,7 +289,7 @@ jobs: name: macOS + iOS (unsigned) runs-on: macos-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: subosito/flutter-action@v2 with: flutter-version: ${{ env.FLUTTER_VERSION }} @@ -310,7 +310,7 @@ jobs: mkdir -p Payload cp -R build/ios/iphoneos/Runner.app Payload/ zip -qry "dist/markdown-studio-ios-unsigned.ipa" Payload - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: release-apple path: dist/ @@ -326,8 +326,8 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v4 - - uses: actions/download-artifact@v4 + - uses: actions/checkout@v7 + - uses: actions/download-artifact@v8 with: pattern: release-* merge-multiple: true