| # GitHub actions at Flutter |
| |
| Action workflows can be enabled by writing a yaml file inside .github/workflows |
| folder of a given repository. These workflows run arbitrary code from GitHub |
| repositories and with read/write permissions in the repository assets. This can |
| be dangerous as anyone with write permissions to the repository can enable |
| workflows using malicious code. To mitigate this only workflows with pinned |
| commits within an allowed list can be executed. |
| |
| Flutter repositories have workflows enabled with readonly ACLs by default. The |
| ACLs can be overwritten providing specific permissions in the configuration |
| file. |
| |
| Determining whether a given workflow is secure or not goes well beyond flutter's |
| capacity and it is the responsibility of the person enabling the workflow to |
| diligently check the workflow for any potential security issues. |
| |
| ## Adding a new GitHub Actions workflow |
| |
| To add a new workflow please open a new bug using the [ticket queue process](Infra-Ticket-Queue.md). The following data points are required: |
| |
| * Description/reason to enable this workflow |
| * workflow repository |
| * pinned commit |
| |
| ## Updating a GitHub Actions workflow |
| |
| To update an existing workflow please open a new bug using the [ticket queue process](Infra-Ticket-Queue.md). The following data points are required: |
| |
| * Description/reason to update the pinned version |
| * workflow/old_pinned_version |
| * workflow/new_pinned_version |
| |
| ## flutter/engine and flutter/flutter |
| |
| ***flutter/engine*** please do not add any action workflows to this repository. |
| The preferred way of building and testing is to use LUCI. This allows to plan |
| for scalability, security and maintainability. |
| |
| ***flutter/flutter*** the main use of workflows in this repo is to process bugs, |
| projects, etc. Please do not use action workflows to build, run tests or release |
| artifacts. |
| |
| ## Checklist |
| |
| New workflow: |
| |
| * Does it have an associated bug? |
| * Was the workflow/commit added to the allow list? Is the workflow pinned to a |
| given commit? |
| * If the workflow require write access, is it overriding the ACLs explicitly? |
| * If the target repository has branch protection, is the configuration using |
| ***secrets.FLUTTERGITHUBBOT_TOKEN*** instead of the default one? |
| * Is the workflow configured to not run on forks? |
| |
| Update workflow: |
| |
| * Does it have an associated bug? |
| * Was the workflow with old and new commits added to the allowed list? |
