CI will break whenever subosito/flutter-action is updated

_↴ Ported from [flutter/genui#818](https://github.com/flutter/genui/issues/818) — originally opened by [andrewkolos](https://github.com/andrewkolos) on 2026-03-20._
_Original labels: P2, front-line-handled, sprint ready, tech_debt_

---

See https://github.com/flutter/genui/pull/812, which was later re-introduced (https://github.com/flutter/genui/issues/816#issuecomment-4094184175).

We could/should do one of the following

1) update the flutter org's allowlist to permit any version of subosito/flutter-action using a wildcard (if we trust it enough--I've not investigated this)
2) stop dependabot from bumping this version (con: we never get any fixes/patches made to it)
3) just handle checking out flutter ourselves, avoiding dependency on subosito/flutter-action altogether (experimented with here: https://github.com/flutter/genui/pull/802/changes/77b9d351abb712ea5e7fcee21a4892562af86db3..a41db5aa98b9edaee21f83e2caf14b886854fdb1)

Look at the GitHub Actions workflow files in .github/workflows to find where subosito/flutter-action is used. Examine the linked PR #802 changes to see the alternative approach of checking out Flutter directly. Determine if the allowlist can be updated in the flutter org's settings or if the dependency should be pinned. Test any changes by running the CI locally or in a fork.

由索引模型根据 Issue 内容生成。