pubのdependabotがpubspec.lockのsha256を削除してしまうため、pub getしてコミットするGithub Actionsのワークフロー

pub_get.yaml

name: pub get

on:
  pull_request:
    paths:
      - packages/**/pubspec.yaml
      - packages/**/pubspec.lock

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  FLUTTER_VERSION: "3.10.0" # FIXME

jobs:
  pub_get:
    if: github.actor == 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
      - name: GitHub App token
        uses: tibdex/github-app-token@v1.8.0
        id: generate_token
        with:
          app_id: ${{ secrets.APP_ID }}
          private_key: ${{ secrets.APP_PRIVATE_KEY }}

      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          token: ${{ steps.generate_token.outputs.token }}

      - uses: actions/cache@v3
        with:
          path: _flutter
          key: ${{ runner.os }}-flutter-${{ env.FLUTTER_VERSION }}

      - name: Install Flutter
        run: .github/workflows/scripts/install_flutter.sh $FLUTTER_VERSION

      - name: Add global pub cache to PATH
        run: echo "$HOME/.pub-cache/bin/" >> $GITHUB_PATH

      - name: Melos
        run: |
          flutter pub global activate melos
          melos pub:get

      - name: Commit
        env:
          GENERATE_TOKEN: ${{ steps.generate_token.outputs.token }}
        run: |
          git remote set-url origin https://github-actions:${GENERATE_TOKEN}@github.com/${GITHUB_REPOSITORY}
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git add packages/*/pubspec.lock
          git commit -m "fix: pubspec.lock" || true
          git push

      ### Slack ###
      - name: Notify Slack
        uses: 8398a7/action-slack@v3
        if: always()
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        with:
          fields: "all"
          mention: "channel"
          if_mention: "failure"
          status: ${{ job.status }}

dependabot/dependabot-core#6929
が解決されるまでの暫定対応として活用した