action.yml resolves its two dependencies by floating major tag:
subosito/flutter-action@v2actions/cache@v6
A floating tag is a mutable pointer, so anyone consuming Project516/setup-flutter@v1 runs whatever those tags point at on the day their job starts. This repo is published on the Marketplace, which makes that everyone's problem, not just ours. subosito/flutter-action moved to SHA-pinning templates itself in its #399, and the repos that consume this action already SHA-pin their own uses: lines.
Pin both to full commit SHAs with the version in a trailing comment, the shape Renovate understands and updates:
uses: subosito/flutter-action@<sha> # v2.23.0
uses: actions/cache@<sha> # v6.1.0
Renovate is already configured here, so the pins stay current through PRs rather than silently.
Maintenance check on both dependencies, done 2026-08-26:
actions/cache: official, active. Latest v6.1.0 (2026-06-26), repo pushed 2026-07-15.subosito/flutter-action: not archived, no deprecation notice, 2.6k stars. Latest release v2.23.0 (2026-03-25), last commit 2026-04-30. Quieter than it was, but alive and still the standard. flutter-actions/setup-flutter is the nearest alternative at 40 stars, which is not a reason to move.
action.ymlresolves its two dependencies by floating major tag:subosito/flutter-action@v2actions/cache@v6A floating tag is a mutable pointer, so anyone consuming
Project516/setup-flutter@v1runs whatever those tags point at on the day their job starts. This repo is published on the Marketplace, which makes that everyone's problem, not just ours.subosito/flutter-actionmoved to SHA-pinning templates itself in its #399, and the repos that consume this action already SHA-pin their ownuses:lines.Pin both to full commit SHAs with the version in a trailing comment, the shape Renovate understands and updates:
Renovate is already configured here, so the pins stay current through PRs rather than silently.
Maintenance check on both dependencies, done 2026-08-26:
actions/cache: official, active. Latest v6.1.0 (2026-06-26), repo pushed 2026-07-15.subosito/flutter-action: not archived, no deprecation notice, 2.6k stars. Latest release v2.23.0 (2026-03-25), last commit 2026-04-30. Quieter than it was, but alive and still the standard.flutter-actions/setup-flutteris the nearest alternative at 40 stars, which is not a reason to move.