From d877745762224d8d1d453f52015ca7501077d5fe Mon Sep 17 00:00:00 2001
From: Sem Van Broekhoven <144097969+dotsem@users.noreply.github.com>
Date: Thu, 12 Nov 2026 13:48:04 +0100
Subject: [PATCH] feat: add timeouts & permissions & cleanup from split

---
 .github/workflows/cd.yml | 27 +++++++++++++++++++++++----
 .github/workflows/ci.yml | 15 +++++++++++----
 2 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index deb093d..746b88f 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -8,7 +8,7 @@ on:
         required: true
         type: string
       tag:
-        description: "Release tag (optional, defaults to release event or ref)"
+        description: "Release tag (required unless triggered by a release or tag push)"
         required: false
         type: string
       flutter-version:
@@ -30,17 +30,35 @@ concurrency:
   group: flutter-cd-${{ inputs.tag || github.event.release.tag_name || github.ref }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   setup-matrix:
     name: Resolve Matrix
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
+      tag: ${{ steps.tag.outputs.tag }}
     steps:
+      # Never fall back to a branch name: the upload action would create a release and tag named after it.
+      - name: Resolve release tag
+        id: tag
+        shell: bash
+        env:
+          TAG: ${{ inputs.tag || github.event.release.tag_name || (github.ref_type == 'tag' && github.ref_name) || '' }}
+        run: |
+          if [ -z "$TAG" ]; then
+            echo "::error::No release tag: pass the 'tag' input, or trigger on a release or tag push"
+            exit 1
+          fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
       - id: set-matrix
         # @main is rewritten to the exact release tag by internal-release.yml
         # nosemgrep: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
-        uses: dotsem/actions/flutter-matrix@main
+        uses: dotactions/flutter/matrix@main
         with:
           targets: ${{ inputs.targets }}
 
@@ -48,6 +66,7 @@ jobs:
     name: Build & Upload (${{ matrix.target }})
     needs: [setup-matrix]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
     permissions:
       contents: write
     strategy:
@@ -60,7 +79,7 @@ jobs:
         id: build
         # @main is rewritten to the exact release tag by internal-release.yml
         # nosemgrep: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
-        uses: dotsem/actions/build-flutter@main
+        uses: dotactions/flutter/build@main
         with:
           target: ${{ matrix.target }}
           flutter-version: ${{ inputs.flutter-version }}
@@ -71,5 +90,5 @@ jobs:
           repo_token: ${{ secrets.token || secrets.GITHUB_TOKEN }}
           file: ${{ steps.build.outputs.artifact-path }}
           file_glob: true
-          tag: ${{ inputs.tag || github.event.release.tag_name || github.ref_name }}
+          tag: ${{ needs.setup-matrix.outputs.tag }}
           overwrite: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 84d2baa..61e32d6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,10 +49,14 @@ on:
         type: number
         default: 4
 
+permissions:
+  contents: read
+
 jobs:
   setup-matrix:
     name: Resolve Matrix
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
       build-mode: ${{ steps.set-matrix.outputs.build-mode }}
@@ -60,7 +64,7 @@ jobs:
       - id: set-matrix
         # @main is rewritten to the exact release tag by internal-release.yml
         # nosemgrep: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
-        uses: dotsem/actions/flutter-matrix@main
+        uses: dotactions/flutter/matrix@main
         with:
           targets: ${{ inputs.targets }}
           pr-targets: ${{ inputs.pr-targets }}
@@ -72,12 +76,13 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Flutter
         # @main is rewritten to the exact release tag by internal-release.yml
         # nosemgrep: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
-        uses: dotsem/actions/setup-flutter@main
+        uses: dotactions/flutter/setup@main
         with:
           flutter-version: ${{ inputs.flutter-version }}
           working-directory: ${{ inputs.working-directory }}
@@ -87,12 +92,13 @@ jobs:
   test:
     name: Run Tests
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Flutter
         # @main is rewritten to the exact release tag by internal-release.yml
         # nosemgrep: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
-        uses: dotsem/actions/setup-flutter@main
+        uses: dotactions/flutter/setup@main
         with:
           flutter-version: ${{ inputs.flutter-version }}
           working-directory: ${{ inputs.working-directory }}
@@ -105,6 +111,7 @@ jobs:
     name: Build (${{ matrix.target }} - ${{ needs.setup-matrix.outputs.build-mode }})
     needs: [setup-matrix, analyze, test]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:
@@ -115,7 +122,7 @@ jobs:
         id: build
         # @main is rewritten to the exact release tag by internal-release.yml
         # nosemgrep: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
-        uses: dotsem/actions/build-flutter@main
+        uses: dotactions/flutter/build@main
         with:
           target: ${{ matrix.target }}
           flutter-version: ${{ inputs.flutter-version }}