fix(ci): install Flutter from a pinned archive instead of subosito/flutter-action

The org Actions policy admits GitHub-owned actions only, so
subosito/flutter-action could not resolve even SHA-pinned, and every workflow
referencing it failed at startup with no check reported. The nine green checks
on this PR are all Wiz/Snyk/semgrep — no build has ever run here.

There is no actions/setup-flutter, so the SDK is fetched from the official
release archive and verified against its published SHA-256
(flutter_linux_3.29.2-stable.tar.xz), cached by version in the tool cache.
That is a stronger supply-chain guarantee than the action it replaces, which
SHA-pins its own code but not the SDK it downloads.

Artifactory OIDC stays on the repo-local action: twilio/sdk-actions covers
npm, python, ruby, php, go, maven, dotnet and gradle, but not pub/dart.

Author: MichaelGHSeg

.github/actions/setup-flutter/action.yml

@@ -0,0 +1,66 @@
+name: "Setup Flutter"
+description: "Install a pinned Flutter SDK from the official release archive"
+
+# The org Actions policy allows GitHub-owned actions/* only (no Marketplace,
+# no verified creators), so third-party setup actions cannot be used here.
+# There is no actions/setup-flutter, so the SDK is installed inline.
+
+inputs:
+  flutter-version:
+    description: "Flutter SDK version to install from the stable channel"
+    required: false
+    default: "3.29.2"
+  sha256:
+    description: "Expected SHA-256 of the Linux SDK archive. Empty skips verification."
+    required: false
+    default: ""
+
+runs:
+  using: "composite"
+  steps:
+    - name: Restore Flutter SDK cache
+      id: flutter-cache
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      with:
+        path: ${{ runner.tool_cache }}/flutter
+        key: flutter-${{ runner.os }}-${{ runner.arch }}-${{ inputs.flutter-version }}
+
+    - name: Download Flutter SDK
+      if: steps.flutter-cache.outputs.cache-hit != 'true'
+      shell: bash
+      env:
+        FLUTTER_VERSION: ${{ inputs.flutter-version }}
+        EXPECTED_SHA256: ${{ inputs.sha256 }}
+      run: |
+        set -euo pipefail
+
+        ARCHIVE="flutter_linux_${FLUTTER_VERSION}-stable.tar.xz"
+        URL="https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/${ARCHIVE}"
+
+        echo "Downloading ${URL}"
+        curl -fsSL --retry 3 --retry-delay 5 -o "${RUNNER_TEMP}/${ARCHIVE}" "${URL}"
+
+        if [ -n "${EXPECTED_SHA256}" ]; then
+          echo "${EXPECTED_SHA256}  ${RUNNER_TEMP}/${ARCHIVE}" | sha256sum -c -
+        else
+          echo "::warning::No sha256 supplied — skipping archive integrity check"
+        fi
+
+        mkdir -p "${RUNNER_TOOL_CACHE}/flutter"
+        tar -xJf "${RUNNER_TEMP}/${ARCHIVE}" -C "${RUNNER_TOOL_CACHE}/flutter" --strip-components=1
+        rm -f "${RUNNER_TEMP}/${ARCHIVE}"
+
+    - name: Add Flutter to PATH
+      shell: bash
+      run: |
+        set -euo pipefail
+        echo "${RUNNER_TOOL_CACHE}/flutter/bin" >> "${GITHUB_PATH}"
+        echo "${RUNNER_TOOL_CACHE}/flutter/bin/cache/dart-sdk/bin" >> "${GITHUB_PATH}"
+
+    - name: Verify Flutter toolchain
+      shell: bash
+      run: |
+        set -euo pipefail
+        # The SDK ships as a git checkout; the tool shells out to git against it.
+        git config --global --add safe.directory "${RUNNER_TOOL_CACHE}/flutter"
+        flutter --version

.github/workflows/ci.yml

@@ -13,11 +13,13 @@ permissions:
 
 env:
   ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }}
+  FLUTTER_SUPPRESS_ANALYTICS: "true"
+  FLUTTER_VERSION: "3.29.2"
 
 jobs:
   test:
     name: Test - ${{ matrix.package }}
-    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
+    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-latest-large' }}
     strategy:
       fail-fast: false
       matrix:
@@ -38,10 +40,11 @@ jobs:
           distribution: 'zulu'
           java-version: '17'
 
-      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
+      - name: Setup Flutter
+        uses: ./.github/actions/setup-flutter
         with:
-          channel: stable
-          flutter-version: 3.29.2
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+          sha256: 6096f21370773093ec19240e133664c1c12eb8b5a85605a92d16ce462a18eac4
 
       - name: Authenticate with Artifactory
         if: ${{ !github.event.pull_request.head.repo.fork }}

.github/workflows/publish.yml

@@ -16,11 +16,13 @@ permissions:
 
 env:
   ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }}
+  FLUTTER_SUPPRESS_ANALYTICS: "true"
+  FLUTTER_VERSION: "3.29.2"
 
 jobs:
   test:
     name: Pre-publish tests
-    runs-on: ubuntu-x64
+    runs-on: ubuntu-latest-large
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
@@ -30,10 +32,11 @@ jobs:
           distribution: 'zulu'
           java-version: '17'
 
-      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
+      - name: Setup Flutter
+        uses: ./.github/actions/setup-flutter
         with:
-          channel: stable
-          flutter-version: 3.29.2
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+          sha256: 6096f21370773093ec19240e133664c1c12eb8b5a85605a92d16ce462a18eac4
 
       - name: Authenticate with Artifactory
         uses: ./.github/actions/artifactory-oidc
@@ -48,17 +51,18 @@ jobs:
 
   publish:
     name: Publish to pub.dev
-    runs-on: ubuntu-x64
+    runs-on: ubuntu-latest-large
     needs: [test]
     environment: production
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
+      - name: Setup Flutter
+        uses: ./.github/actions/setup-flutter
         with:
-          channel: stable
-          flutter-version: 3.29.2
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+          sha256: 6096f21370773093ec19240e133664c1c12eb8b5a85605a92d16ce462a18eac4
 
       - name: Publish to pub.dev (Trusted Publishing)
         run: dart pub publish --force