Align DWDS in the SDK with DWDS in Webdev

.github/workflows/changelog_reminder.yml

@@ -13,9 +13,13 @@ jobs:
     if: ${{ !contains(github.event.*.labels.*.name, 'changelog-not-required') }}
     name: Maybe prevent submission
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
       - name: Check changed files
         run: |
           git fetch origin main

.github/workflows/daily_stable_testing.yml

@@ -16,6 +16,8 @@ jobs:
   testing_stable:
     name: Testing Dart Stable SDK
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Set up stable Dart SDK
         uses: dart-lang/setup-dart@e51d8e571e22473a2ddebf0ef8a2123f0ab2c02c
@@ -31,6 +33,7 @@ jobs:
         id: checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           ref: webdev-v${{ steps.version.outputs.VERSION_TAG }}
       - name: Upgrade deps
         id: webdev_pub_upgrade

.github/workflows/daily_testing.yml

@@ -10,6 +10,8 @@ jobs:
   daily_testing:
     name: Daily Testing
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Setup Dart SDK
         uses: dart-lang/setup-dart@e51d8e571e22473a2ddebf0ef8a2123f0ab2c02c
@@ -18,6 +20,8 @@ jobs:
       - id: checkout
         name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
       - id: dwds_pub_upgrade
         name: dwds; dart pub upgrade
         run: dart pub upgrade

.github/workflows/dcm.yml

@@ -12,6 +12,8 @@ jobs:
   dcm:
     name: Dart Code Metrics
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Install DCM
         run: |
@@ -29,6 +31,7 @@ jobs:
         name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           ref: "${{ github.event.pull_request.head.sha }}"
       - id: dwds_pub_upgrade
         name: dwds; dart pub upgrade

.github/workflows/do_not_submit.yml

@@ -11,6 +11,7 @@ jobs:
     if: ${{ contains(github.event.*.labels.*.name, 'do-not-submit') }}
     name: Prevent submission
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Check for do-not-submit label
         run: |

.github/workflows/publish.yaml

@@ -12,7 +12,7 @@ on:
 jobs:
   publish:
     if: ${{ github.repository_owner == 'dart-lang' }}
-    uses: dart-lang/ecosystem/.github/workflows/publish.yaml@main
+    uses: dart-lang/ecosystem/.github/workflows/publish.yaml@ed9c592c1d35106c0a8a52044426515017a60646
     with:
       sdk: dev
     permissions:

.github/workflows/pull_request_label.yml

@@ -5,7 +5,8 @@
 # https://github.com/actions/labeler.
 
 name: Pull Request Labeler
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request_target

.github/workflows/release_reminder.yml

@@ -11,11 +11,15 @@ jobs:
     if: ${{ !contains(github.event.*.labels.*.name, 'prepare-release') }}
     name: Maybe prevent submission
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Setup Dart SDK
         uses: dart-lang/setup-dart@e51d8e571e22473a2ddebf0ef8a2123f0ab2c02c
         with:
           sdk: dev
       - id: checkout
         name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false

dwds/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 27.1.3-wip
+
+- Internal test infrastructure refactoring: Move common test files to `dwds_test_common`.
+
 ## 27.1.2
 
 - Bump the min sdk to 3.13.0-107.0.dev.