From 20db467e6ace58d733b70b82ebe0645fa85b6437 Mon Sep 17 00:00:00 2001
From: project516 <138796702+Project516@users.noreply.github.com>
Date: Mon, 3 Aug 2026 10:52:23 -0500
Subject: [PATCH 1/2] ci: verify the composite action across runner OSes

Add a workflow that runs the action on Linux, macOS, and Windows (both
channel and pinned-version inputs), then asserts Flutter is on PATH, the
pub cache is populated at the OS-correct PUB_CACHE location, and pub get
resolved the fixture pubspec.
---
 .github/workflows/verify.yml | 70 ++++++++++++++++++++++++++++++++++++
 .gitignore                   |  2 ++
 pubspec.yaml                 | 10 ++++++
 3 files changed, 82 insertions(+)
 create mode 100644 .github/workflows/verify.yml
 create mode 100644 .gitignore
 create mode 100644 pubspec.yaml

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
new file mode 100644
index 0000000..43d4cd4
--- /dev/null
+++ b/.github/workflows/verify.yml
@@ -0,0 +1,70 @@
+name: verify
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: ${{ matrix.os }}${{ matrix.label }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            channel: stable
+            flutter-version: ""
+            label: " / stable"
+          - os: macos-latest
+            channel: stable
+            flutter-version: ""
+            label: " / stable"
+          - os: windows-latest
+            channel: stable
+            flutter-version: ""
+            label: " / stable"
+          - os: ubuntu-latest
+            channel: ""
+            flutter-version: "3.44.4"
+            label: " / pinned 3.44.4"
+          - os: windows-latest
+            channel: ""
+            flutter-version: "3.44.4"
+            label: " / pinned 3.44.4"
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: ./
+        with:
+          flutter-version: ${{ matrix.flutter-version }}
+          channel: ${{ matrix.channel }}
+
+      - name: Verify Flutter is on PATH
+        shell: bash
+        run: flutter --version
+
+      - name: Verify pub cache location and contents
+        shell: bash
+        run: |
+          echo "PUB_CACHE=$PUB_CACHE"
+          expected="$HOME/.pub-cache"
+          if [ "$RUNNER_OS" = "Windows" ]; then
+            expected="$LOCALAPPDATA/Pub/Cache"
+          fi
+          norm() { printf '%s' "$1" | tr '\\' '/' | tr '[:upper:]' '[:lower:]'; }
+          if [ "$(norm "$PUB_CACHE")" != "$(norm "$expected")" ]; then
+            echo "expected PUB_CACHE to be $expected" >&2
+            exit 1
+          fi
+          test -d "$PUB_CACHE" || { echo "PUB_CACHE directory missing" >&2; exit 1; }
+          test -d "$PUB_CACHE/hosted" || { echo "no hosted packages cached" >&2; exit 1; }
+
+      - name: Verify pub get resolved the fixture
+        shell: bash
+        run: test -f .dart_tool/package_config.json
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..05d0295
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+.dart_tool/
+pubspec.lock
diff --git a/pubspec.yaml b/pubspec.yaml
new file mode 100644
index 0000000..3e81818
--- /dev/null
+++ b/pubspec.yaml
@@ -0,0 +1,10 @@
+name: setup_flutter_fixture
+description: Minimal Flutter fixture used by CI to verify the setup-flutter composite action.
+publish_to: none
+version: 0.1.0
+
+environment:
+  sdk: ^3.0.0
+
+dependencies:
+  http: ^1.2.0

From 8b0ac88fda6c2c1df8ff25828300cde9f99f9922 Mon Sep 17 00:00:00 2001
From: project516 <138796702+Project516@users.noreply.github.com>
Date: Mon, 3 Aug 2026 12:03:25 -0500
Subject: [PATCH 2/2] ci: address CodeRabbit review

- Grant contents:read permissions only
- Pin actions/checkout to commit SHA with persist-credentials: false
- Add beta channel to the matrix and verify flutter --version matches the requested channel/version
- Assert http resolves from under PUB_CACHE in package_config.json
- Key caches on pubspec.yaml so hashFiles resolves without a committed lockfile
---
 .github/workflows/verify.yml | 50 ++++++++++++++++++++++++++++++++----
 README.md                    |  2 +-
 action.yml                   |  6 ++---
 3 files changed, 49 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 43d4cd4..7b8c840 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -29,6 +32,10 @@ jobs:
             channel: stable
             flutter-version: ""
             label: " / stable"
+          - os: ubuntu-latest
+            channel: beta
+            flutter-version: ""
+            label: " / beta"
           - os: ubuntu-latest
             channel: ""
             flutter-version: "3.44.4"
@@ -38,16 +45,27 @@ jobs:
             flutter-version: "3.44.4"
             label: " / pinned 3.44.4"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
 
       - uses: ./
         with:
           flutter-version: ${{ matrix.flutter-version }}
           channel: ${{ matrix.channel }}
 
-      - name: Verify Flutter is on PATH
+      - name: Verify Flutter matches the requested version
         shell: bash
-        run: flutter --version
+        env:
+          EXPECTED_CHANNEL: ${{ matrix.channel }}
+          EXPECTED_VERSION: ${{ matrix.flutter-version }}
+        run: |
+          flutter --version 2>&1 | tee /tmp/flutter-version.txt
+          if [ -n "$EXPECTED_VERSION" ]; then
+            grep -q "Flutter ${EXPECTED_VERSION} " /tmp/flutter-version.txt || { echo "expected Flutter $EXPECTED_VERSION" >&2; exit 1; }
+          else
+            grep -q "channel ${EXPECTED_CHANNEL}" /tmp/flutter-version.txt || { echo "expected channel $EXPECTED_CHANNEL" >&2; exit 1; }
+          fi
 
       - name: Verify pub cache location and contents
         shell: bash
@@ -65,6 +83,28 @@ jobs:
           test -d "$PUB_CACHE" || { echo "PUB_CACHE directory missing" >&2; exit 1; }
           test -d "$PUB_CACHE/hosted" || { echo "no hosted packages cached" >&2; exit 1; }
 
-      - name: Verify pub get resolved the fixture
+      - name: Verify pub get resolved http from the pub cache
         shell: bash
-        run: test -f .dart_tool/package_config.json
+        run: |
+          test -f .dart_tool/package_config.json
+          PY=python3
+          command -v python3 >/dev/null 2>&1 || PY=python
+          "$PY" - "$PUB_CACHE" <<'EOF'
+          import json, os, sys, urllib.parse
+          pub_cache = os.path.normcase(os.path.realpath(sys.argv[1]))
+          base = os.path.dirname(os.path.abspath(".dart_tool/package_config.json"))
+          with open(".dart_tool/package_config.json") as f:
+              packages = json.load(f)["packages"]
+          http = next((p for p in packages if p["name"] == "http"), None)
+          assert http is not None, "http package missing from package_config.json"
+          root = http["rootUri"]
+          if "://" in root:
+              root = urllib.parse.urlparse(root).path
+              if os.name == "nt" and root.startswith("/"):
+                  root = root[1:]
+          if not os.path.isabs(root):
+              root = os.path.join(base, root)
+          root = os.path.normcase(os.path.realpath(root))
+          assert root.startswith(pub_cache), f"{root} not under PUB_CACHE {pub_cache}"
+          print(f"http resolved under PUB_CACHE ({root})")
+          EOF
diff --git a/README.md b/README.md
index fb05260..943af2f 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ One composite action for the three-step block every Flutter CI job repeats:
 install Flutter, restore the pub cache, run `flutter pub get`. Wraps
 [subosito/flutter-action](https://github.com/subosito/flutter-action) and
 [actions/cache](https://github.com/actions/cache), with both caches keyed on
-`pubspec.lock`.
+`pubspec.yaml`.
 
 ## Usage
 
diff --git a/action.yml b/action.yml
index c21af1e..f27e812 100644
--- a/action.yml
+++ b/action.yml
@@ -1,5 +1,5 @@
 name: Setup Flutter with pub cache
-description: Install Flutter, restore the pub cache keyed on pubspec.lock, and run flutter pub get, as a single step.
+description: Install Flutter, restore the pub cache keyed on pubspec.yaml, and run flutter pub get, as a single step.
 branding:
   icon: download
   color: blue
@@ -23,7 +23,7 @@ runs:
         flutter-version: ${{ inputs.flutter-version }}
         channel: ${{ inputs.channel }}
         cache: true
-        cache-key: flutter-${{ runner.os }}-${{ hashFiles('pubspec.lock') }}
+        cache-key: flutter-${{ runner.os }}-${{ hashFiles('pubspec.yaml') }}
 
     - name: Cache pub
       uses: actions/cache@v6
@@ -36,7 +36,7 @@ runs:
         # instead misses the real cache directory on Windows runners, where
         # Flutter writes pub packages to %LOCALAPPDATA%\Pub\Cache by default.
         path: ${{ env.PUB_CACHE }}
-        key: ${{ runner.os }}-pub-${{ hashFiles('pubspec.lock') }}
+        key: ${{ runner.os }}-pub-${{ hashFiles('pubspec.yaml') }}
         restore-keys: |
           ${{ runner.os }}-pub-