CI/CD Automation: Automated Flutter SDK Version Bumping & Integrity Verification

Why This Matters

To ensure stable and reproducible builds, our CI/CD scripts are pinned to a specific stable version of the Flutter SDK in tool/provision_flutter.sh (see: #8951). Manually monitoring and upgrading this pin is tedious, while a rolling pin risks introducing silent test breakages.

This PR automates the maintenance of our pinned Flutter SDK version with safe, presubmit-verified upgrades, backed by compile-time integrity checks to prevent syntax or synchronization bugs.

Fixes: #8953

Proposed Changes

1. Automated Version-Pin Bumping

• [NEW] .github/workflows/update_flutter.yaml: Added a scheduled weekly GitHub Actions workflow (running every Monday at midnight) that:
  • Queries the official Flutter GCS manifest API for new stable releases.
  • Extracts and compares the latest version with our current pin inside tool/provision_flutter.sh.
  • If a newer version is available, it automatically edits the version constant in the script and opens a structured Pull Request so that standard presubmit checks run against the new version prior to merging.

2. Compile-Time Integrity Verification

• [NEW] testSrc/unit/io/flutter/CIIntegrityTest.java: Added a custom JUnit meta-test to enforce synchronization between the provisioning script and the GitHub Action:
  • testFlutterProvisioningScriptIntegrity(): Asserts tool/provision_flutter.sh exists and contains a valid semver-formatted FLUTTER_VERSION="..." constant.
  • testGitHubWorkflowRegexSync(): Asserts .github/workflows/update_flutter.yaml matches the exact constant pattern used in its search-and-replace step.
  • Why this is here: Prevents silent setup failures if a developer renames or reformats the version constant in the future.

Verification Results

1. JUnit Integrity Tests: Ran the integrity suite locally:

   ./gradlew test --tests io.flutter.CIIntegrityTest
   

Result: BUILD SUCCESSFUL (Both assertions compiled and passed successfully in 4 seconds).

2. Local Run:

Until this is landed the action can't be tested on GH but this verifies that it should work:

☁  flutter-intellij [infra_flutterSdkWorkflow] ⚡  # 1. Read the current pinned version from the script (should print 3.41.0)
CURRENT_VERSION=$(grep -E 'FLUTTER_VERSION="[0-9.]+"' tool/provision_flutter.sh | head -n 1 | cut -d'"' -f2)
echo "Current pinned version: $CURRENT_VERSION"
# 2. Query the live Flutter API for the latest stable release version (should print 3.41.9+)
LATEST_VERSION=$(curl -s https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json | jq -r '.releases | map(select(.channel == "stable"))[0].version')
echo "Latest stable version: $LATEST_VERSION"
# 3. Run the comparison and update logic
if [ "$CURRENT_VERSION" != "$LATEST_VERSION" ]; then
  echo "New stable version detected: $LATEST_VERSION. Updating script..."

  # Perform the replacement (cross-compatible sed for macOS)
  sed -i "" "s/FLUTTER_VERSION=\"$CURRENT_VERSION\"/FLUTTER_VERSION=\"$LATEST_VERSION\"/g" tool/provision_flutter.sh

  echo "Successfully updated! Checking file content:"
  grep "FLUTTER_VERSION=" tool/provision_flutter.sh
else
  echo "Flutter SDK is already up to date."
fi
Current pinned version: 3.41.0
Latest stable version: 3.41.9
New stable version detected: 3.41.9. Updating script...
Successfully updated! Checking file content:
  FLUTTER_VERSION="3.41.9"

Review the contribution guidelines below:

• I’ve reviewed the contributor guide and applied the relevant portions to this PR.
• I've included the required information in the description above.
• My up-to-date information is in the AUTHORS file.
• I've updated CHANGELOG.md if appropriate.