From 8f4d64103ed202d1e85aa00d34241ca555af36ff Mon Sep 17 00:00:00 2001
From: iota9star <iota9star@foxmail.com>
Date: Thu, 13 Aug 2026 22:14:29 +0800
Subject: [PATCH 1/2] chore(ci): pin actions, harden credentials, scope
 permissions

---
 .github/workflows/deploy.yml | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ce7e09d..842c565 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -6,10 +6,7 @@ on:
       - main
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+permissions: contents: read
 
 concurrency:
   group: "pages"
@@ -20,10 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Flutter
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           channel: stable
           cache: true
@@ -37,11 +36,15 @@ jobs:
         run: flutter build web --release --base-href /
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: example/build/web
 
   deploy:
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
@@ -50,4 +53,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

From bd17560b31f3c865e2f4da30b1a0214e495ac06f Mon Sep 17 00:00:00 2001
From: iota9star <iota9star@foxmail.com>
Date: Thu, 13 Aug 2026 22:30:42 +0800
Subject: [PATCH 2/2] fix(ci): correct YAML syntax for permissions block in
 deploy.yml

The previous security hardening wrote 'permissions: contents: read' as a
single-line YAML mapping, which is invalid. Split into proper multi-line
format.
---
 .github/workflows/deploy.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 842c565..ece3073 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -6,7 +6,8 @@ on:
       - main
   workflow_dispatch:
 
-permissions: contents: read
+permissions:
+  contents: read
 
 concurrency:
   group: "pages"