[sync] 2026/06/03

.github/workflows/codeql-analysis.yml

@@ -33,7 +33,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba
+      uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -44,7 +44,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba
+      uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -58,4 +58,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba
+      uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa

.github/workflows/compile_host_redirect_js.yml

@@ -18,12 +18,13 @@ env:
 
 jobs:
   compile_host_redirect_js:
-    if: ${{ github.actor.login != 'cfug-dev' &&
-            github.repository == 'cfug/flutter.cn' }}
+    if: |
+      github.actor.login != 'cfug-dev' &&
+      github.repository == 'cfug/flutter.cn'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-      - uses: actions/setup-node@670825a89dc0abd596e7a3abd0f5e3f6e5faf37c
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Build JS

.github/workflows/dart.yml

@@ -0,0 +1,72 @@
+name: Dart code
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**/*.dart'
+      - '**/pubspec.yaml'
+      - '**/pubspec.lock'
+      - '**/analysis_options.yaml'
+      - 'examples/**'
+      - 'packages/**'
+      - 'tool/dash_site/**'
+      - '.github/workflows/dart.yml'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - '**/*.dart'
+      - '**/pubspec.yaml'
+      - '**/pubspec.lock'
+      - '**/analysis_options.yaml'
+      - 'examples/**'
+      - 'packages/**'
+      - 'tool/dash_site/**'
+      - '.github/workflows/dart.yml'
+  # schedule:
+  #   - cron: '0 0 * * 0'
+
+permissions: read-all
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  test:
+    name: Analyze and test Dart (${{ matrix.name }})
+    runs-on: ubuntu-latest
+    if: github.repository == 'cfug/flutter.cn'
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: "Beta channel"
+            branch: beta
+            experimental: false
+          - name: "Stable channel"
+            branch: stable
+            experimental: true
+    continue-on-error: ${{ matrix.experimental }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: subosito/flutter-action@e938fdf56512cc96ef2f93601a5a40bde3801046
+        with:
+          channel: ${{ matrix.branch }}
+      - name: Fetch Dart dependencies
+        run: dart pub get
+        continue-on-error: ${{ matrix.experimental }}
+# Disabled for now due to non-language versioned formatting changes.
+# TODO(parlough): Revisit this once standardized on 3.13 beta or newer.
+#      - name: Check Dart code formatting
+#        run: dart run dash_site format-dart --check
+#        continue-on-error: ${{ matrix.experimental }}
+      - name: Analyze Dart code
+        run: dart run dash_site analyze-dart
+        continue-on-error: ${{ matrix.experimental }}
+      - name: Run Dart tests
+        run: dart run dash_site test-dart
+        continue-on-error: ${{ matrix.experimental }}

.github/workflows/build.yml → .github/workflows/docs.yml

@@ -1,54 +1,49 @@
-name: build
+name: Docs site
 
 on:
   push:
     branches:
       - main
+    paths:
+      - 'sites/docs/**'
+      - 'examples/**'
+      - 'packages/excerpter/**'
+      - 'firebase.json'
+      - 'tool/dash_site/**'
+      - 'tool/config/linkcheck-skip-list.txt'
+      - 'pubspec.yaml'
+      - 'pubspec.lock'
+      - 'analysis_options.yaml'
+      - '.github/workflows/docs.yml'
   pull_request:
     branches:
       - main
+    paths:
+      - 'sites/docs/**'
+      - 'examples/**'
+      - 'packages/excerpter/**'
+      - 'firebase.json'
+      - 'tool/dash_site/**'
+      - 'tool/config/linkcheck-skip-list.txt'
+      - 'pubspec.yaml'
+      - 'pubspec.lock'
+      - 'analysis_options.yaml'
+      - '.github/workflows/docs.yml'
+  # schedule:
+  #   - cron: '0 0 * * 0'
 
-# Declare default permissions as read only.
 permissions: read-all
 
-jobs:
-  test:
-    name: Analyze and test code examples
-    runs-on: ubuntu-latest
-    if: github.repository == 'cfug/flutter.cn'
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: "Beta channel"
-            branch: beta
-            experimental: false
-          - name: "Stable channel"
-            branch: stable
-            experimental: true
-    continue-on-error: ${{ matrix.experimental }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-      - uses: subosito/flutter-action@e938fdf56512cc96ef2f93601a5a40bde3801046
-        with:
-          channel: ${{ matrix.branch }}
-      - name: Fetch Dart dependencies
-        run: dart pub get
-        continue-on-error: ${{ matrix.experimental }}
-      - name: Check Dart code formatting
-        run: dart run dash_site format-dart --check
-        continue-on-error: ${{ matrix.experimental }}
-      - name: Analyze Dart code
-        run: dart run dash_site analyze-dart
-        continue-on-error: ${{ matrix.experimental }}
-      - name: Run Dart tests
-        run: dart run dash_site test-dart
-        continue-on-error: ${{ matrix.experimental }}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+jobs:
   excerpts:
-    name: Check if code excerpts are up to date
+    name: Check code excerpts
     runs-on: ubuntu-latest
     if: github.repository == 'cfug/flutter.cn'
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
@@ -57,14 +52,13 @@ jobs:
       - name: Fetch Dart dependencies
         run: dart pub get
       - name: Check if excerpts are up to date
-        run: dart run dash_site refresh-excerpts --fail-on-update --dry-run
-        continue-on-error: ${{ matrix.experimental }}
+        run: dart run dash_site --site=docs refresh-excerpts --fail-on-update --dry-run
 
   linkcheck:
-    name: Build site and check links
+    name: Build and check links
     runs-on: ubuntu-latest
-    timeout-minutes: 30
     if: github.repository == 'cfug/flutter.cn'
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
@@ -73,24 +67,25 @@ jobs:
       - name: Fetch Dart dependencies
         run: dart pub get
       - name: Install firebase-tools
-        run: curl -sL https://firebase.tools/ | sed s/latest/v15.2.1/ | bash
+        run: curl -sL https://firebase.tools | bash
       - name: Build site
-        run: dart run dash_site build
-      - uses: actions/setup-node@670825a89dc0abd596e7a3abd0f5e3f6e5faf37c
+        run: dart run dash_site --site=docs build
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: 24
       - name: Translated (docs.flutter.cn)
         run: bash tool/translator/build.sh
         shell: bash
       - name: Check for broken Markdown link references
-        run: dart run dash_site check-link-references
+        run: dart run dash_site --site=docs check-link-references
       - name: Check for broken internal links
-        run: dart run dash_site check-links
+        run: dart run dash_site --site=docs check-links
 
   firebase-validate:
     name: Validate Firebase configuration
     runs-on: ubuntu-latest
     if: github.repository == 'cfug/flutter.cn'
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
@@ -99,11 +94,11 @@ jobs:
       - name: Fetch Dart dependencies
         run: dart pub get
       - name: Validate the firebase.json file
-        run: dart run dash_site verify-firebase-json
+        run: dart run dash_site --site=docs verify-firebase-json
 
   deploy:
     name: Deploy to production
-    needs: [test, excerpts, linkcheck, firebase-validate]
+    needs: [excerpts, linkcheck, firebase-validate]
     runs-on: ubuntu-latest
     if: |
       github.event_name == 'push' &&
@@ -120,8 +115,8 @@ jobs:
       - name: Fetch Dart dependencies
         run: dart pub get
       - name: Build site
-        run: dart run dash_site build --release
-      - uses: actions/setup-node@670825a89dc0abd596e7a3abd0f5e3f6e5faf37c
+        run: dart run dash_site --site=docs build --release
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: 24
       - name: Translated (docs.flutter.cn)

.github/workflows/stage.yml

@@ -15,7 +15,8 @@ jobs:
       checks: write
       pull-requests: write
     runs-on: ubuntu-latest
-    if: ${{ github.event.pull_request.head.repo.full_name == 'cfug/flutter.cn' }}
+    if: |
+      github.event.pull_request.head.repo.full_name == 'cfug/flutter.cn'
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
@@ -27,17 +28,17 @@ jobs:
       - name: Fetch Dart dependencies
         run: dart pub get
       - name: Build site
-        run: dart run dash_site build --release
-      - uses: actions/setup-node@670825a89dc0abd596e7a3abd0f5e3f6e5faf37c
+        run: dart run dash_site --site=docs build --release
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: 24
       - name: Translated (docs.flutter.cn)
         run: bash tool/translator/build.sh
         shell: bash
       - name: Stage
-        if: ${{
+        if: |
           github.repository == 'cfug/flutter.cn' &&
-          github.event.pull_request.user.login != 'dependabot[bot]' }}
+          github.event.pull_request.user.login != 'dependabot[bot]'
         uses: cfug/doc-site-preview-in-pr@main
         with:
           repoToken: '${{ secrets.GITHUB_TOKEN }}'

cloud_build/firebase-ghcli/Dockerfile

@@ -1,4 +1,4 @@
-FROM dart:3.12.0@sha256:3d1b19886b288807b42020ede8f1f9ea7753c91c17c27479ee9e7bf584289a34
+FROM dart:3.12.1@sha256:6440c7d5fd8713b0706d0b6190eb2be7ad896101e225fc9d7657034b23ab0592
 
 RUN apt-get update && apt-get install -y --no-install-recommends curl gpg ca-certificates \
     # Install the GitHub CLI. \

cloud_build/firebase-ghcli/README.md

@@ -18,3 +18,64 @@ When the `Dockerfile` file or `cloudbuild.yaml` template in this directory
 are changed in a PR, the cloud build template is triggered.
 Then a new version of the image is deployed as the latest version in
 Container Registry under the `flutter-dev-230821` project on Google Cloud.
+
+## Updating the Dart SDK version
+
+The base Dart image in `Dockerfile` is pinned by both tag and digest:
+
+```dockerfile
+FROM dart:<version>@<digest>
+```
+
+When updating the Dart SDK version, update both the tag and the digest.
+Use the multi-platform image index digest for the tag.
+Don't use a platform-specific digest, such as
+the digest for only `linux/amd64` or only `linux/arm64/v8`.
+
+### Using `crane`
+
+If you have the `crane` CLI from [`google/go-containerregistry`][], run:
+
+```bash
+crane digest docker.io/library/dart:<STABLE_DART_SDK_VERSION>
+```
+
+For example, the following command retrieves the digest for
+the `3.12.1` stable release of the SDK:
+
+```bash
+crane digest docker.io/library/dart:3.12.1
+```
+
+Copy the returned `sha256:...` digest.
+Then update the `FROM` line in the `Dockerfile` with
+the new tag (version) and copied index digest.
+
+```dockerfile
+FROM dart:3.12.1@<digest from crane>
+```
+
+Don't pass `--platform` when getting the digest for the `Dockerfile`.
+Passing a platform returns the digest for that platform's child manifest
+instead of the architecture-agnostic index digest.
+
+[`google/go-containerregistry`]: https://github.com/google/go-containerregistry
+
+### Using Docker Hub
+
+If you don't have `crane`, use the
+[Dart image tags page on Docker Hub](https://hub.docker.com/_/dart/tags):
+
+1.  Search for the new Dart SDK version tag, such as `3.12.1`.
+1.  Open the tag detail page by selecting the tag name or digest.
+1.  Ensure the opened tag page has a `MULTI-PLATFORM` badge.
+1.  Copy the specified `INDEX DIGEST` value.
+    It should start with `sha256:`.
+1.  Update the `FROM` line in the `Dockerfile` with
+    the new tag (SDK version) and index digest.
+
+<img
+  width="688"
+  height="248"
+  alt="Screenshot of the index digest on Docker Hub, outlined with a red box."
+  src="https://github.com/user-attachments/assets/909bd713-580f-41f5-882b-9afb3b9bbfaf" />

examples/_animation/basic_hero_animation/pubspec.yaml

@@ -5,7 +5,7 @@ description: >-
 
 resolution: workspace
 environment:
-  sdk: ^3.12.0-0
+  sdk: ^3.12.0
 
 dependencies:
   flutter:

examples/_animation/basic_radial_hero_animation/pubspec.yaml

@@ -6,7 +6,7 @@ description: >-
 
 resolution: workspace
 environment:
-  sdk: ^3.12.0-0
+  sdk: ^3.12.0
 
 dependencies:
   flutter: