[efraespada]

Esta PR incorpora en develop la alineación de runners de master (#156), conservando los 76 commits de aplicación pendientes. Los workflows usan el grupo vypdev con Linux/codex, macOS ARM64 o Windows X64 según su plataforma. Se mantienen los 55 jobs originales de validación y sus matrices SwiftPM/CocoaPods, workspace/pub-cache y Android moderno/legacy, además de la publicación completa y ordenada de los diez paquetes con tags inmutables.

La preparación de CI usa configuración Flutter privada por job, Git Bash explícito en Windows, simuladores propios y dependencias Linux descargadas/extractadas en un prefijo privado. Las bibliotecas de Chrome se resuelven con nombres time64 o legacy según los índices APT del sistema; se cubren Ubuntu 22.04 y 24.04 sin modificar dpkg ni usar sudo. Android instala el emulador antes de validar sus ejecutables y no recibe cabeceras del host que interfieran con el NDK. AArch64 y Emscripten conservan sus sysroots.

La admisión del hotfix exige la rama configurada y su versión antes del checkout y de cualquier permiso de escritura (dos pruebas con seis refs, rojas antes del arreglo). La preparación de release y hotfix comparte una acción compuesta que actualiza y valida versiones, changelogs, metadatos Apple y Wasm. La comprobación final de pub.dev provisiona Dart. La notificación usa Copilot v3; la integración de ramas requiere PR revisadas. El chequeo de credenciales incorpora el transporte por stdin de vypdev/copilot#682.

Validación local: actionlint completo y whitespace OK; dos regresiones del SDK Android (rojas antes del arreglo), tres contratos con las herramientas Dart reales y dos contratos nativos Docker linux/amd64 bajo UID1000, sin privilegios ni socket del host. Tanto Ubuntu 22.04 como 24.04 compilan GTK y AArch64, ejecutan LCOV/bc y lanzan Chrome real conservando el hash dpkg. El fallo original de paquetes t64 se reproduce en Ubuntu 22.04 antes del arreglo.

El fallo aislado de CompileStoryboard se ha investigado: la misma compilación directa pasa con el HOME privado y con el normal. Se conservan ahora el log verbose de la compilación y el diagnóstico del simulador si reaparece; no se atribuye una causa no demostrada. Todos los casos iOS siguen activos.

No se ha despachado una publicación de Zstandard. El merge de esta PR exige todos los checks aplicables del último commit correctos, revisión completa y cero findings pendientes.

[vypbot]

Bugbot: 1 finding needs attention

Current status: 1 finding requires attention on 58798e5.

Action: Review the linked threads or comment /copilot fix all.

Findings

• open — Hotfix preparation pushes to the dispatch ref without validating it

Pull request · Verified commit · Workflow run

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.10%. Comparing base (16a489f) to head (84d0e03).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #157   +/-   ##
========================================
  Coverage    54.10%   54.10%           
========================================
  Files           12       12           
  Lines          573      573           
========================================
  Hits           310      310           
  Misses         263      263           

Flag	Coverage Δ
cli	49.70% <ø> (ø)
platform_interface	85.71% <ø> (ø)
zstandard	87.03% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 58798e5. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit 3a63324 was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: Browser dependencies exclude Ubuntu 22.04 package names — .github/actions/setup-linux-dependencies/action.yml:46

[vypbot]

Current status: 1 finding originating in this review requires attention.
Last reconciled on 58798e5. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit 58798e5 was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• high: Hotfix preparation pushes to the dispatch ref without validating it — .github/workflows/hotfix_workflow.yml:94

[vypbot]

Hotfix preparation pushes to the dispatch ref without validating it

Severity: high

Category: correctness · Confidence: 97%

Location: .github/workflows/hotfix_workflow.yml:94-96

The preparation job checks out the ref that dispatched the workflow and then pushes the generated version changes to that ref, but the workflow no longer checks that it is running from the matching hotfix/<version> branch. A manual dispatch from develop, master, or another branch therefore commits release-version changes directly to that branch instead of a hotfix branch.
Evidence:
actions/checkout@​v5 uses its default ref, which for workflow_dispatch is the selected branch. The preparation step commits those checked-out files and git push origin "HEAD:$HOTFIX_BRANCH" sets HOTFIX_BRANCH to github.ref_name. There is no branch-name or version-to-branch validation in validate or before the push; the old workflow also pushed to the selected ref, but this change makes preparation a real version-changing operation and does not constrain it to a hotfix branch.

Suggested fix:
Validate that github.ref_name is the expected hotfix branch for the supplied version before checking out or pushing, and fail closed for other refs.