release: promote dev to prod — 1.0.0#5
Merged
Merged
Conversation
…3.11 floor, README banner
…cription * ci: gold-parity workflow sweep — release runner choice, submodule checkouts, honest job names * ci: gate evaluates this repo's jobs; package-test legs; consumer-owned pins * deps: lock refresh * build: bump the core pin — Windows key-separator fix * ci: bump whuppi/ci pins to v2.0.3 — release-tool output forwarding fix * docs: tighten the README and pubspec description * ci: bump whuppi/ci pins to v2.0.4; verbose flutter output on CI
* feat: consume the core as a hosted dependency Replaces the cellar git submodule with the published package (^1.0.0-dev.0, lock-certified). Local co-development uses a gitignored pubspec_overrides.yaml; unreleased-core testing uses a throwaway PR with a git-ref override. Deletes the submodule, .gitmodules, the release swap hook, the platforms swap wrapper, the analyzer exclude, and the recursive checkouts; docs updated to the hosted model. * docs: version-tag the core links, guarded by a test * docs: trim the genesis changelog entry * docs: re-pin the core security-policy link the negative-proof restore undid * fix: regenerate the lockfiles against the hosted core * chore: format
* docs: novice-first description and topics * docs: stable 1.0.0 changelog entry * docs: novice-first README hook
This comment has been minimized.
This comment has been minimized.
github-actions
Bot
added
docs
slopfairy
approved these changes
Jul 9, 2026
slopfairy
left a comment
slopfairy
left a comment
There was a problem hiding this comment.
Tip
Approved — clean promotion from dev, all changes are release-scoped: submodule to hosted dep, CI parity, docs, and assets
🟡 Suggestions — optional, take it or leave it
.pubignore— thedeploy/directory ships to pub.dev. Its contents are in a hidden.deploy/subdirectory which pub does exclude, so the package gets an emptydeploy/directory. Adddeploy/to.pubignoreto keep it clean.
✅ Checked
- All 39 files reviewed — no lib/src/ Dart source changes; this is purely a dependency, CI, docs, and asset promotion
- Workflow security: no
pull_request_targetcheckout of PR-head code; the onepull_request_targettrigger (triage.yml) delegates to the hardened reusable workflow; release.yml triggers onpush(not fork-triggerable); allwhuppi/cireferences pinned to v2.0.4 tags; all third-party actions are SHA-pinned pubspec.yaml:version: 0.0.0is correct — the release tool stamps it fromCHANGELOG.mdat publish time;cellar: ^1.0.0is the correct hosted constraint;publish_to: noneremoved as expectedpubspec.lock: cellar 1.0.0 (hosted from pub.dev), transitive deps updated (matcher, meta, test_api, vm_service — all patch bumps, no breakage)deploy/.deploy/secrets.sh: scoped strictly towhuppi/cellar_flutter, dev/prod environments only, no hardcoded secrets,secrets.json.examplecontains only placeholder valuestool/ci/upgrade.sh: version string validated withgrep -qE '^[A-Za-z0-9._+-]+$'before write; uses environment-based awk (no sed injection); fail-closed curl- New
test/core_link_pin_test.dart: enforces that doc links into the core repo stay version-synced with the pubspec constraint — a bump PR that forgets the links fails CI CHANGELOG.md1.0.0 entry matches the release scope- Banner assets: optimized webp shipped, heavy 3x PNG sources git-tracked but excluded from pub archive via
.pubignore analysis_options.yaml:cellar/**exclude removed — correct since the submodule is gone
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes dev for the first stable release, on the stable core. Merging fires the prod-lane Release, pausing at the prod environment approval.
Tests: full matrix green on every PR that landed on dev.
Breaking: No.