From 2e1a3464a53496b6e6292afb906a3e0435d96ebe Mon Sep 17 00:00:00 2001
From: Muzahidul Islam <muzahidul.islam@optimizely.com>
Date: Fri, 16 Oct 2026 10:26:13 +0600
Subject: [PATCH 1/2] ci: update flutter.yml actions off retired Node runtimes

- actions/checkout v2/v3 -> v5, actions/setup-java v2 -> v5 (Node 24)
- coverallsapp/github-action@master -> @v2 (master is a stale branch on Node 16)
- quote $GITHUB_ENV (shellcheck SC2086)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/flutter.yml | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/flutter.yml b/.github/workflows/flutter.yml
index a471907..6012cdd 100644
--- a/.github/workflows/flutter.yml
+++ b/.github/workflows/flutter.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: macos-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v5
     - name: Install Flutter
       uses: subosito/flutter-action@v2
       with:
@@ -33,14 +33,14 @@ jobs:
     - name: Test app
       run: flutter test --coverage
     - name: Upload coverage to Coveralls
-      uses: coverallsapp/github-action@master
+      uses: coverallsapp/github-action@v2
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         
   integration_android_tests:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v5
       with:
         # You should create a personal access token and store it in your repository
         token: ${{ secrets.CI_USER_TOKEN }}
@@ -52,14 +52,14 @@ jobs:
         HEAD_REF: ${{ github.head_ref }}
       if: ${{ github.event_name == 'pull_request' }}
       run: |
-        echo "SDK_BRANCH=$HEAD_REF" >> $GITHUB_ENV
+        echo "SDK_BRANCH=$HEAD_REF" >> "$GITHUB_ENV"
     - name: set SDK Branch if not pull request
       env:
         REF_NAME: ${{ github.ref_name }}
       if: ${{ github.event_name != 'pull_request' }}
       run: |
-        echo "SDK_BRANCH=$REF_NAME" >> $GITHUB_ENV
-        echo "TRAVIS_BRANCH=$REF_NAME" >> $GITHUB_ENV
+        echo "SDK_BRANCH=$REF_NAME" >> "$GITHUB_ENV"
+        echo "TRAVIS_BRANCH=$REF_NAME" >> "$GITHUB_ENV"
     - name: Trigger build
       env:
         SDK: android
@@ -82,7 +82,7 @@ jobs:
   integration_ios_tests:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v5
       with:
         # You should create a personal access token and store it in your repository
         token: ${{ secrets.CI_USER_TOKEN }}
@@ -94,14 +94,14 @@ jobs:
         HEAD_REF: ${{ github.head_ref }}
       if: ${{ github.event_name == 'pull_request' }}
       run: |
-        echo "SDK_BRANCH=$HEAD_REF" >> $GITHUB_ENV
+        echo "SDK_BRANCH=$HEAD_REF" >> "$GITHUB_ENV"
     - name: set SDK Branch if not pull request
       env:
         REF_NAME: ${{ github.ref_name }}
       if: ${{ github.event_name != 'pull_request' }}
       run: |
-        echo "SDK_BRANCH=$REF_NAME" >> $GITHUB_ENV
-        echo "TRAVIS_BRANCH=$REF_NAME" >> $GITHUB_ENV
+        echo "SDK_BRANCH=$REF_NAME" >> "$GITHUB_ENV"
+        echo "TRAVIS_BRANCH=$REF_NAME" >> "$GITHUB_ENV"
     - name: Trigger build
       env:
         SDK: ios
@@ -125,7 +125,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
       - uses: subosito/flutter-action@v2
         with:
           flutter-version: '3.44.0'
@@ -135,7 +135,7 @@ jobs:
           cache-path: ${{ runner.tool_cache }}/flutter
           architecture: x64
       - name: Setup java
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'
           java-version: '11'
@@ -146,7 +146,7 @@ jobs:
     runs-on: macos-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v5
     - uses: subosito/flutter-action@v2
       with:
         flutter-version: '3.44.0'

From 3ae8c707d5d320d1e1bd2eea9d4afc63194a623e Mon Sep 17 00:00:00 2001
From: Muzahidul Islam <muzahidul.islam@optimizely.com>
Date: Fri, 16 Oct 2026 17:35:57 +0600
Subject: [PATCH 2/2] ci: stop persisting checkout credentials in flutter.yml

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/flutter.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/flutter.yml b/.github/workflows/flutter.yml
index 6012cdd..8fd72c1 100644
--- a/.github/workflows/flutter.yml
+++ b/.github/workflows/flutter.yml
@@ -22,6 +22,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: Install Flutter
       uses: subosito/flutter-action@v2
       with:
@@ -42,6 +44,7 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with:
+        persist-credentials: false
         # You should create a personal access token and store it in your repository
         token: ${{ secrets.CI_USER_TOKEN }}
         repository: 'optimizely/ci-helper-tools'
@@ -84,6 +87,7 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with:
+        persist-credentials: false
         # You should create a personal access token and store it in your repository
         token: ${{ secrets.CI_USER_TOKEN }}
         repository: 'optimizely/ci-helper-tools'
@@ -126,6 +130,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: subosito/flutter-action@v2
         with:
           flutter-version: '3.44.0'
@@ -147,6 +153,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - uses: subosito/flutter-action@v2
       with:
         flutter-version: '3.44.0'