From d4fbdd3576a3a7ab679c7b4956d6cac66d35c940 Mon Sep 17 00:00:00 2001
From: Mark Siazon <67873853+Iron-Mark@users.noreply.github.com>
Date: Wed, 19 Aug 2026 10:51:44 +0800
Subject: [PATCH 1/2] Pin third-party Actions

---
 .github/workflows/android-production-release.yml | 4 ++--
 .github/workflows/flutter-ci.yml                 | 6 +++---
 .github/workflows/flutter-web-pages.yml          | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/android-production-release.yml b/.github/workflows/android-production-release.yml
index 77fcd65..c46cc82 100644
--- a/.github/workflows/android-production-release.yml
+++ b/.github/workflows/android-production-release.yml
@@ -68,7 +68,7 @@ jobs:
           java-version: "17"
 
       - name: Set up Android SDK
-        uses: android-actions/setup-android@v4
+        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4
         with:
           packages: ""
 
@@ -80,7 +80,7 @@ jobs:
           sdkmanager "platform-tools" "platforms;android-36" "build-tools;36.1.0" "ndk;28.0.13004108"
 
       - name: Set up Flutter
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           channel: stable
           flutter-version: "3.41.9"
diff --git a/.github/workflows/flutter-ci.yml b/.github/workflows/flutter-ci.yml
index e027714..19b47f6 100644
--- a/.github/workflows/flutter-ci.yml
+++ b/.github/workflows/flutter-ci.yml
@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Flutter
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           channel: stable
           flutter-version: "3.41.9"
@@ -143,7 +143,7 @@ jobs:
           java-version: "17"
 
       - name: Set up Android SDK
-        uses: android-actions/setup-android@v4
+        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4
         with:
           packages: ""
 
@@ -154,7 +154,7 @@ jobs:
           sdkmanager "platform-tools" "platforms;android-36" "build-tools;36.1.0" "ndk;28.0.13004108"
 
       - name: Set up Flutter
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           channel: stable
           flutter-version: "3.41.9"
diff --git a/.github/workflows/flutter-web-pages.yml b/.github/workflows/flutter-web-pages.yml
index ca60dd7..638e929 100644
--- a/.github/workflows/flutter-web-pages.yml
+++ b/.github/workflows/flutter-web-pages.yml
@@ -119,7 +119,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Flutter
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           channel: stable
           flutter-version: "3.41.9"

From 08230671c375e94f6ab82498e026ab192f1f2ed0 Mon Sep 17 00:00:00 2001
From: Mark Siazon <67873853+Iron-Mark@users.noreply.github.com>
Date: Wed, 19 Aug 2026 11:02:53 +0800
Subject: [PATCH 2/2] Update workflow source guards

---
 test/scripts/release_guard_source_test.dart | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/test/scripts/release_guard_source_test.dart b/test/scripts/release_guard_source_test.dart
index d31e5b1..01022a7 100644
--- a/test/scripts/release_guard_source_test.dart
+++ b/test/scripts/release_guard_source_test.dart
@@ -5,6 +5,11 @@ import 'dart:io';
 import 'package:flutter_test/flutter_test.dart';
 
 void main() {
+  const androidSetupAction =
+      'android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699';
+  const flutterAction =
+      'subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2';
+
   late String gradleBuild;
   late String releasePreflight;
   late String storeReleaseBuild;
@@ -2466,7 +2471,7 @@ SUPABASE_PUBLISHABLE_KEY=sb_publishable_abcdefghijklmnopqrstuvwxyz123456
   });
 
   test('ci installs Android SDK packages explicitly after setup-android', () {
-    expect(ciWorkflow, contains('android-actions/setup-android@v4'));
+    expect(ciWorkflow, contains(androidSetupAction));
     expect(ciWorkflow, contains('packages: ""'));
     expect(
       ciWorkflow,
@@ -2476,7 +2481,7 @@ SUPABASE_PUBLISHABLE_KEY=sb_publishable_abcdefghijklmnopqrstuvwxyz123456
       ),
     );
     expect(
-      ciWorkflow.indexOf('android-actions/setup-android@v4'),
+      ciWorkflow.indexOf(androidSetupAction),
       lessThan(ciWorkflow.indexOf('sdkmanager "platform-tools"')),
     );
   });
@@ -2491,8 +2496,18 @@ SUPABASE_PUBLISHABLE_KEY=sb_publishable_abcdefghijklmnopqrstuvwxyz123456
       expect(workflow, isNot(contains('actions/upload-artifact@v4')));
     }
     expect(ciWorkflow, contains('actions/setup-java@v5'));
-    expect(ciWorkflow, contains('android-actions/setup-android@v4'));
+    expect(ciWorkflow, contains(androidSetupAction));
+    expect(androidProductionReleaseWorkflow, contains(androidSetupAction));
+    for (final workflow in [
+      ciWorkflow,
+      pagesWorkflow,
+      androidProductionReleaseWorkflow,
+    ]) {
+      expect(workflow, contains(flutterAction));
+      expect(workflow, isNot(contains('subosito/flutter-action@v2')));
+    }
     expect(ciWorkflow, isNot(contains('actions/setup-java@v4')));
+    expect(ciWorkflow, isNot(contains('android-actions/setup-android@v4')));
     expect(ciWorkflow, isNot(contains('android-actions/setup-android@v3')));
   });