2.0.0-rc.3: security fixes, CI pipeline and docs cleanup

.github/ISSUE_TEMPLATE/---bug-report.md

@@ -1,6 +1,6 @@
 ---
 name: "\U0001F41B Bug report"
-about: Something isn't working? Create a report to help us improve Flyer Chat.
+about: Something isn't working? Create a report to help us improve Flutter Supabase Chat Core.
 title: ''
 labels: bug
 assignees: ''
@@ -75,4 +75,4 @@ OS version (e.g. iOS 14.5, Android 11): ...
 
 Add any other context about the problem here.
 
-<!-- Thank you for making us better 🤝--!>
+<!-- Thank you for making us better 🤝 -->

.github/ISSUE_TEMPLATE/---feature-request.md

@@ -1,6 +1,6 @@
 ---
 name: "⚡️ Feature request"
-about: Suggest an idea to help make Flyer Chat even better!
+about: Suggest an idea to help make Flutter Supabase Chat Core even better!
 title: ''
 labels: feature
 assignees: ''

.github/dependabot.yml

@@ -0,0 +1,31 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ['*']
+
+  - package-ecosystem: pub
+    directory: /
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: pub
+    directory: /example
+    schedule:
+      interval: weekly
+    groups:
+      example:
+        patterns: ['*']
+
+  # The documentation site (Docusaurus): build-time only.
+  - package-ecosystem: npm
+    directory: /doc
+    schedule:
+      interval: weekly
+    groups:
+      docusaurus:
+        patterns: ['*']

.github/workflows/ci.yaml

@@ -0,0 +1,117 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze and unit tests (Flutter ${{ matrix.flutter }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # The minimum version declared in pubspec.yaml, and the latest stable.
+        flutter: ['3.35.0', 'stable']
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: subosito/flutter-action@v2
+        with:
+          flutter-version: ${{ matrix.flutter != 'stable' && matrix.flutter || '' }}
+          channel: stable
+          cache: true
+
+      # The example app may need a newer SDK than the package minimum: on the
+      # minimum version only the package itself is resolved and analyzed.
+      - name: Install dependencies
+        run: flutter pub get ${{ matrix.flutter != 'stable' && '--no-example' || '' }}
+
+      # Formatting output can differ between Dart versions: checked on the
+      # latest stable only.
+      - name: Check formatting
+        if: matrix.flutter == 'stable'
+        run: dart format . --set-exit-if-changed
+
+      - name: Analyze
+        run: flutter analyze --no-pub ${{ matrix.flutter != 'stable' && 'lib test' || '' }}
+
+      # The integration tests (tag `integration`) need the Supabase stack:
+      # see the integration job.
+      - name: Unit tests
+        run: flutter test --no-pub --exclude-tags integration --coverage
+
+      # The 10 points of the example/screenshots check are only granted on
+      # pub.dev: any other lost point fails the job.
+      - name: pub.dev score (pana)
+        if: matrix.flutter == 'stable'
+        run: |
+          dart pub global activate pana
+          pana --no-warning --exit-code-threshold 10 .
+
+  integration:
+    name: Database and integration tests
+    runs-on: ubuntu-latest
+    needs: analyze
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+          cache: true
+
+      - uses: supabase/setup-cli@v1
+        with:
+          version: 2.117.0
+
+      - name: Install dependencies
+        run: flutter pub get
+
+      - name: Start the local Supabase stack
+        run: supabase start
+
+      # Applies example/utils/sql exactly as end users do.
+      - name: Apply the chat schema
+        run: bash tool/local_db.sh
+
+      - name: Database tests (pgTAP)
+        run: supabase test db
+
+      - name: Integration tests
+        run: bash tool/test_integration.sh --no-reset
+
+      - name: Stop the local Supabase stack
+        if: always()
+        run: supabase stop --no-backup
+
+  docs:
+    name: Documentation site
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: doc/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: doc
+
+      # onBrokenLinks: 'throw' fails the build on a broken link.
+      - name: Build
+        run: npm run build
+        working-directory: doc

.github/workflows/deploy-pages.yaml

@@ -1,34 +1,57 @@
-name: Deploy GitHub pages
+name: Deploy documentation
 
 on:
   push:
     branches: [main]
+    paths:
+      - 'doc/**'
+      - 'CNAME'
+      - '.github/workflows/deploy-pages.yaml'
+  workflow_dispatch:
+
+# Requires Settings > Pages > Source: "GitHub Actions".
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
 
 jobs:
-  deploy:
+  build:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: 20
+          cache: npm
+          cache-dependency-path: doc/package-lock.json
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
         working-directory: doc
 
-      - name: Build site
+      - name: Build
         run: npm run build
         working-directory: doc
 
-      - name: Add CNAME file
-        run: cp ./CNAME ./doc/build/CNAME
+      - name: Add CNAME
+        run: cp CNAME doc/build/CNAME
 
-      - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v3
+      - uses: actions/upload-pages-artifact@v3
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./doc/build
+          path: doc/build
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/publish.yaml

@@ -0,0 +1,49 @@
+name: Publish to pub.dev
+
+# Runs when a version tag is pushed (e.g. v2.0.0, v2.0.0-rc.3), then waits for
+# a manual approval: the `pub.dev` environment must have required reviewers
+# (Settings > Environments). Authentication is GitHub OIDC, no stored secret:
+# on pub.dev, Admin > Automated publishing must enable GitHub Actions for
+# this repository with tag pattern `v{{version}}` and require the `pub.dev`
+# environment.
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pub.dev
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      # Configures the OIDC token pub.dev accepts.
+      - uses: dart-lang/setup-dart@v1
+
+      - uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+
+      - name: Check the tag matches pubspec.yaml
+        run: |
+          version="$(grep -E '^version:' pubspec.yaml | awk '{print $2}')"
+          if [ "v${version}" != "${GITHUB_REF_NAME}" ]; then
+            echo "Tag ${GITHUB_REF_NAME} does not match pubspec.yaml version ${version}"
+            exit 1
+          fi
+
+      - name: Install dependencies
+        run: flutter pub get
+
+      - name: Dry run
+        run: dart pub publish --dry-run
+
+      - name: Publish
+        run: dart pub publish --force