Raj-StepSecurity · Oct 7, 2026 · Oct 7, 2026 · Oct 7, 2026 · Oct 7, 2026
diff --git a/.github/workflows/actions_release.yml b/.github/workflows/actions_release.yml
@@ -0,0 +1,22 @@
+name: Release GitHub Actions
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag for the release"
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+
+    uses: step-security/reusable-workflows/.github/workflows/actions_release.yaml@v1
+    with:
+      tag: "${{ github.event.inputs.tag }}"
diff --git a/.github/workflows/auto_cherry_pick.yml b/.github/workflows/auto_cherry_pick.yml
@@ -0,0 +1,37 @@
+name: Auto Cherry-Pick from Upstream
+
+on:
+  workflow_run:
+    workflows: [ "Release GitHub Actions" ]
+    types:
+      - completed
+
+  workflow_dispatch:
+    inputs:
+      base_branch:
+        description: "Base branch to create the PR against"
+        required: true
+        default: "main"
+      mode:
+        description: "Run mode: cherry-pick or verify"
+        required: false
+        default: "cherry-pick"
+
+  pull_request:
+    types: [ opened, synchronize, labeled ]
+
+permissions:
+  contents: write
+  pull-requests: write
+  packages: read
+  issues: write
+
+jobs:
+  cherry-pick:
+    if: (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || github.event_name == 'workflow_dispatch' || contains(fromJson(toJson(github.event.pull_request.labels)).*.name, 'review-required')
+    uses: step-security/reusable-workflows/.github/workflows/auto_cherry_pick.yaml@v1
+    with:
+      original-owner: "subosito"
+      repo-name: "flutter-action"
+      base_branch: ${{ inputs.base_branch || 'main' }}
+      mode: ${{ github.event_name == 'pull_request' && 'verify' || inputs.mode || 'cherry-pick' }}
diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
@@ -0,0 +1,307 @@
+name: test
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths:
+      - setup.sh
+      - action.yaml
+      - .github/workflows/workflow.yaml
+jobs:
+  lint_shellcheck:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v7
+      - name: Run shellcheck
+        uses: step-security/action-shellcheck@v2
+
+  test_channel:
+    runs-on: ${{ matrix.operating-system }}
+
+    strategy:
+      matrix:
+        operating-system: ${{ github.actor == 'dependabot[bot]' && fromJSON('["ubuntu-latest"]') || fromJSON('["ubuntu-latest", "macos-latest", "windows-latest"]') }}
+        channel: ${{ github.actor == 'dependabot[bot]' && fromJSON('["stable"]') || fromJSON('["stable", "beta", "master"]') }}
+        dry-run: ${{ github.actor == 'dependabot[bot]' && fromJSON('[false]') || fromJSON('[true, false]') }}
+        git-source: ${{ github.actor == 'dependabot[bot]' && fromJSON('["https://github.com/flutter/flutter.git"]') || fromJSON('["https://github.com/flutter/flutter.git", "https://github.com/Flutter-Foundation/flutter.git", "https://gitee.com/harmonycommando_flutter/flutter.git"]') }}
+        include:
+          - operating-system: ubuntu-latest
+            channel: main
+
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v7
+      - id: flutter-action
+        uses: ./
+        with:
+          channel: ${{ matrix.channel }}
+          dry-run: ${{ matrix.dry-run }}
+          git-source: ${{ matrix.git-source }}
+      - name: Echo outputs
+        run: |
+          echo RUNNER-OS=${{ runner.os }}
+          echo RUNNER-ARCH=${{ runner.arch }}
+
+          echo CACHE-PATH=${{ steps.flutter-action.outputs.CACHE-PATH }}
+          echo CACHE-KEY=${{ steps.flutter-action.outputs.CACHE-KEY }}
+          echo CHANNEL=${{ steps.flutter-action.outputs.CHANNEL }}
+          echo VERSION=${{ steps.flutter-action.outputs.VERSION }}
+          echo ARCHITECTURE=${{ steps.flutter-action.outputs.ARCHITECTURE }}
+        shell: bash
+      - run: dart --version
+        if: ${{ matrix.dry-run != true }}
+        shell: bash
+      - run: flutter --version
+        if: ${{ matrix.dry-run != true }}
+        shell: bash
+      - run: "! dart --version"
+        if: ${{ matrix.dry-run == true }}
+        shell: bash
+      - run: "! flutter --version"
+        if: ${{ matrix.dry-run == true }}
+        shell: bash
+
+  test_cache:
+    runs-on: ${{ matrix.operating-system }}
+
+    strategy:
+      matrix:
+        operating-system: ${{ github.actor == 'dependabot[bot]' && fromJSON('["ubuntu-latest"]') || fromJSON('["ubuntu-latest", "windows-latest", "macos-latest"]') }}
+
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v7
+      - uses: ./
+        with:
+          channel: stable
+          flutter-version: 3.10.6
+          cache: true
+      - run: dart --version
+        shell: bash
+      - run: flutter --version
+        shell: bash
+
+  test_version_file:
+    runs-on: ${{ matrix.operating-system }}
+
+    strategy:
+      matrix:
+        operating-system: ${{ github.actor == 'dependabot[bot]' && fromJSON('["ubuntu-latest"]') || fromJSON('["ubuntu-latest"]') }}
+
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v7
+      - uses: ./
+        with:
+          channel: stable
+          flutter-version-file: test/pubspec.yaml
+      - name: Verify Dart version
+        run: dart --version | grep '2.18.6'
+        shell: bash
+      - name: Verify Flutter version
+        run: flutter --version | grep '3.3.10'
+        shell: bash
+
+  test_master_version:
+    runs-on: ${{ matrix.operating-system }}
+
+    strategy:
+      matrix:
+        operating-system: ${{ github.actor == 'dependabot[bot]' && fromJSON('["ubuntu-latest"]') || fromJSON('["ubuntu-latest", "macos-latest"]') }}
+
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v7
+      - id: flutter-action
+        uses: ./
+        with:
+          channel: master
+          flutter-version: e6ed6e9e16782a24a912e79d3100c496600aae5b # some commit made on 18/03/2026
+      - name: Echo outputs
+        run: |
+          echo RUNNER-OS=${{ runner.os }}
+          echo RUNNER-ARCH=${{ runner.arch }}
+
+          echo CACHE-PATH=${{ steps.flutter-action.outputs.CACHE-PATH }}
+          echo CACHE-KEY=${{ steps.flutter-action.outputs.CACHE-KEY }}
+          echo CHANNEL=${{ steps.flutter-action.outputs.CHANNEL }}
+          echo VERSION=${{ steps.flutter-action.outputs.VERSION }}
+          echo ARCHITECTURE=${{ steps.flutter-action.outputs.ARCHITECTURE }}
+        shell: bash
+      - run: flutter --version
+        shell: bash
+
+  test_print_output_x64:
+    runs-on: ubuntu-latest
+
+    # These calls to setup.sh sepcify the -t flag, which enables test mode.
+    # Test mode uses hardcoded Flutter release manifests from test/ directory.
+
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v7
+      - run: ./setup.sh -t -p -f test/pubspec.yaml   | grep '3.3.10'
+        shell: bash
+      - run: ./setup.sh -t -p                        | grep 'stable'
+        shell: bash
+      - run: ./setup.sh -t -p                        | grep '3.7.7'
+        shell: bash
+      - run: ./setup.sh -t -p                        | grep 'x64'
+        shell: bash
+      - run: ./setup.sh -t -p stable                 | grep 'stable'
+        shell: bash
+      - run: ./setup.sh -t -p beta                   | grep 'beta'
+        shell: bash
+      - run: ./setup.sh -t -p beta                   | grep '3.9.0-0.1.pre'
+        shell: bash
+      - run: ./setup.sh -t -p -n 3.3.10 stable       | grep '3.3.10'
+        shell: bash
+      - run: ./setup.sh -t -p -n 3.3.1 stable        | grep '3.3.1'
+        shell: bash
+      - run: ./setup.sh -t -p -n 2 stable            | grep '2.10.5'
+        shell: bash
+      - run: ./setup.sh -t -p -n 2 beta              | grep '2.13.0-0.4.pre'
+        shell: bash
+      - run: ./setup.sh -t -p -n 2 any               | grep 'beta'
+        shell: bash
+      - run: ./setup.sh -t -p -n 2 any               | grep '2.13.0-0.4.pre'
+        shell: bash
+      - run: ./setup.sh -t -p -n 3 any               | grep 'beta'
+        shell: bash
+      - run: ./setup.sh -t -p -n 3 any               | grep '3.9.0-0.1.pre'
+        shell: bash
+      - run: ./setup.sh -t -p -n 3 any               | grep 'x64'
+        shell: bash
+      - run: ./setup.sh -t -p -n any stable          | grep 'stable'
+        shell: bash
+      - run: ./setup.sh -t -p -n any stable          | grep '3.7.7'
+        shell: bash
+      - run: ./setup.sh -t -p -n any stable          | grep 'x64'
+        shell: bash
+      - run: ./setup.sh -t -p -n 1 stable            | grep '1.22.6'
+        shell: bash
+      - run: ./setup.sh -t -p -n 0 any               | grep 'beta'
+        shell: bash
+      - run: ./setup.sh -t -p -n 0 any               | grep '0.11.13'
+        shell: bash
+      - run: ./setup.sh -t -p                        | grep 'flutter-linux-stable-3.7.7-x64-2ad6cd72c040113b47ee9055e722606a490ef0da'
+        shell: bash
+      - run: ./setup.sh -t -p stable                 | grep 'flutter-linux-stable-3.7.7-x64-2ad6cd72c040113b47ee9055e722606a490ef0da'
+        shell: bash
+      - run: ./setup.sh -t -p beta                   | grep 'flutter-linux-beta-3.9.0-0.1.pre-x64-f732038a8cf4562ce38a1d7debb30209ae3da896'
+        shell: bash
+      - run: ./setup.sh -t -p dev                    | grep 'flutter-linux-dev-2.13.0-0.1.pre-x64-13a2fb10b838971ce211230f8ffdd094c14af02c'
+        shell: bash
+      - run: ./setup.sh -t -p master                 | grep 'flutter-linux-master-any-x64-master'
+        shell: bash
+      - run: ./setup.sh -t -p -n 5b12b74 master      | grep 'flutter-linux-master-5b12b74-x64-master'
+        shell: bash
+      - run: ./setup.sh -t -p -n 3.12.0-12.0.pre master     | grep 'flutter-linux-master-3.12.0-12.0.pre-x64-master'
+        shell: bash
+      - run: ./setup.sh -t -p -n stable master       | grep 'flutter-linux-master-stable-x64-master'
+        shell: bash
+      - run: ./setup.sh -t -p -n 2 any               | grep 'flutter-linux-beta-2.13.0-0.4.pre-x64-25caf1461b8f643092a9f6f5b224453b5c057d10'
+        shell: bash
+      - run: ./setup.sh -t -p -n 1 any               | grep 'flutter-linux-beta-1.26.0-17.8.pre-x64-044f2cf5607a26f8818dab0f766400e85c52bdff'
+        shell: bash
+      - run: ./setup.sh -t -p -n 0 any               | grep 'flutter-linux-beta-0.11.13-x64-58c8489fcdb4e4ef6c010117584c9b23d15221aa'
+        shell: bash
+      - run: ./setup.sh -t -p                        | grep '/opt/hostedtoolcache/flutter/stable-3.7.7-x64'
+        shell: bash
+      - run: ./setup.sh -t -p stable                 | grep '/opt/hostedtoolcache/flutter/stable-3.7.7-x64'
+        shell: bash
+      - run: ./setup.sh -t -p beta                   | grep '/opt/hostedtoolcache/flutter/beta-3.9.0-0.1.pre-x64'
+        shell: bash
+      - run: ./setup.sh -t -p dev                    | grep '/opt/hostedtoolcache/flutter/dev-2.13.0-0.1.pre-x64'
+        shell: bash
+      - run: ./setup.sh -t -p master                 | grep '/opt/hostedtoolcache/flutter/master-any-x64'
+        shell: bash
+      - run: ./setup.sh -t -p -k 'custom-:channel:-:version:-:hash:'       | grep 'custom-stable-3.7.7-2ad6cd72c040113b47ee9055e722606a490ef0da'
+        shell: bash
+      - run: ./setup.sh -t -p -k 'custom-:channel:-:version:-:sha256:'     | grep 'custom-stable-3.7.7-cdd49597e88c35e5de5184e9acff433dfbb3c075b74ef7b27790af7f57ce2420'
+        shell: bash
+      - run: ./setup.sh -t -p -c '/tmp/flutter/:channel:-:version:-:hash:' | grep '/tmp/flutter/stable-3.7.7-2ad6cd72c040113b47ee9055e722606a490ef0da'
+        shell: bash
+      - run: ./setup.sh -t -p -d '/tmp/flutter/:channel:-:version:-:hash:-pub-cache-path' | grep '/tmp/flutter/stable-3.7.7-2ad6cd72c040113b47ee9055e722606a490ef0da-pub-cache-path'
+        shell: bash
+      - run: ./setup.sh -t -p -l '/tmp/flutter/:channel:-:version:-:hash:-pub-cache-key' | grep '/tmp/flutter/stable-3.7.7-2ad6cd72c040113b47ee9055e722606a490ef0da-pub-cache-key'
+        shell: bash
+
+
+  test_print_output_arm64:
+    if: github.actor != 'dependabot[bot]'
+    runs-on: macos-latest
+
+    # These calls to setup.sh sepcify the -t flag, which enables test mode.
+    # Test mode uses hardcoded Flutter release manifests from test/ directory.
+
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v7
+      - run: ./setup.sh -t -p -f test/pubspec.yaml   | grep '3.3.10'
+        shell: bash
+      - run: ./setup.sh -t -p                        | grep 'stable'
+        shell: bash
+      - run: ./setup.sh -t -p                        | grep '3.7.7'
+        shell: bash
+      - run: ./setup.sh -t -p                        | grep 'arm64'
+        shell: bash
+      - run: ./setup.sh -t -p stable                 | grep 'stable'
+        shell: bash
+      - run: ./setup.sh -t -p beta                   | grep 'beta'
+        shell: bash
+      - run: ./setup.sh -t -p beta                   | grep '3.9.0-0.1.pre'
+        shell: bash
+      - run: ./setup.sh -t -p -n 3.3.10 stable       | grep '3.3.10'
+        shell: bash
+      - run: ./setup.sh -t -p -n 3.3.1 stable        | grep '3.3.1'
+        shell: bash
+      - run: ./setup.sh -t -p -n 3 any               | grep 'beta'
+        shell: bash
+      - run: ./setup.sh -t -p -n 3 any               | grep '3.9.0-0.1.pre'
+        shell: bash
+      - run: ./setup.sh -t -p -n 3 -a arm64 any      | grep 'arm64'
+        shell: bash
+      - run: ./setup.sh -t -p -n any -a arm64 stable | grep 'stable'
+        shell: bash
+      - run: ./setup.sh -t -p -n any -a arm64 stable | grep '3.7.7'
+        shell: bash
+      - run: ./setup.sh -t -p -n any -a arm64 stable | grep 'arm64'
+        shell: bash
+      - run: ./setup.sh -t -p                        | grep 'flutter-macos-stable-3.7.7-arm64-2ad6cd72c040113b47ee9055e722606a490ef0da'
+        shell: bash
+      - run: ./setup.sh -t -p stable                 | grep 'flutter-macos-stable-3.7.7-arm64-2ad6cd72c040113b47ee9055e722606a490ef0da'
+        shell: bash
+      - run: ./setup.sh -t -p beta                   | grep 'flutter-macos-beta-3.9.0-0.1.pre-arm64-8b9b90e75107181aadc303d8d7422205863a35dd'
+        shell: bash
+      - run: ./setup.sh -t -p master                 | grep 'flutter-macos-master-any-arm64-master'
+        shell: bash
+      - run: ./setup.sh -t -p -n 5b12b74 master      | grep 'flutter-macos-master-5b12b74-arm64-master'
+        shell: bash
+      - run: ./setup.sh -t -p -n 3.12.0-12.0.pre master     | grep 'flutter-macos-master-3.12.0-12.0.pre-arm64-master'
+        shell: bash
+      - run: ./setup.sh -t -p -n stable master       | grep 'flutter-macos-master-stable-arm64-master'
+        shell: bash
+      - run: ./setup.sh -t -p                        | grep '/Users/runner/hostedtoolcache/flutter/stable-3.7.7-arm64'
+        shell: bash
+      - run: ./setup.sh -t -p stable                 | grep '/Users/runner/hostedtoolcache/flutter/stable-3.7.7-arm64'
+        shell: bash
+      - run: ./setup.sh -t -p beta                   | grep '/Users/runner/hostedtoolcache/flutter/beta-3.9.0-0.1.pre-arm64'
+        shell: bash
+      - run: ./setup.sh -t -p master                 | grep '/Users/runner/hostedtoolcache/flutter/master-any-arm64'
+        shell: bash
+      - run: ./setup.sh -t -p -k 'custom-:channel:-:version:-:hash:'       | grep 'custom-stable-3.7.7-2ad6cd72c040113b47ee9055e722606a490ef0da'
+        shell: bash
+      - run: ./setup.sh -t -p -k 'custom-:channel:-:version:-:sha256:'     | grep 'custom-stable-3.7.7-0511b9f164a62f467b063e6c83d9c683bb3fb056ee556b2f45e987a2c2f4a260'
+        shell: bash
+      - run: ./setup.sh -t -p -c '/tmp/flutter/:channel:-:version:-:hash:' | grep '/tmp/flutter/stable-3.7.7-2ad6cd72c040113b47ee9055e722606a490ef0da'
+        shell: bash
+      - run: ./setup.sh -t -p -d '/tmp/flutter/:channel:-:version:-:hash:-pub-cache-path' | grep '/tmp/flutter/stable-3.7.7-2ad6cd72c040113b47ee9055e722606a490ef0da-pub-cache-path'
+        shell: bash
+      - run: ./setup.sh -t -p -l '/tmp/flutter/:channel:-:version:-:hash:-pub-cache-key' | grep '/tmp/flutter/stable-3.7.7-2ad6cd72c040113b47ee9055e722606a490ef0da-pub-cache-key'
+        shell: bash
diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2019 Alif Rachmawadi <arch@subosito.com>
+Copyright (c) 2026 StepSecurity
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.