dart_skills_lint v0.4 prep: native binary preview track by reidbaker · Pull Request #158 · flutter/agent-plugins

reidbaker · 2026-06-12T00:32:01Z

Adds a v0.4 with the goal of supporting users that may not have dart installed.

Specifically there is a:

New tag-triggered release workflow (.github/workflows/dart_skills_lint_release.yaml) builds dart_skills_lint as a standalone native binary for macos-arm64, macos-x64, linux-x64, and linux-arm64 via dart compile exe, packages each as a SHA256-verified tarball, and cuts a GitHub Release whose notes are extracted from CHANGELOG.md.
New tool/dart_skills_lint/scripts/install.sh detects OS/arch, downloads the matching tarball, verifies its SHA256 against the release's SHA256SUMS, and installs to INSTALL_DIR (default /usr/local/bin, with sudo fallback). REPO / VERSION / INSTALL_DIR are env-configurable so a future repo migration costs one default-value edit.
pubspec bumped to 0.4.0-dev.1; CHANGELOG and README updated.

What is not done but was considered:

Homebrew formula — deferred until dart_skills_lint settles into its dedicated repo.
macOS code signing & notarization — deferred pending Apple Developer cert approval. README documents the xattr -d com.apple.quarantine workaround for the preview window. This will need to come after launchcal approval.
Windows binaries — no current demand; can be added later if it materializes.

Test plan

Existing dart_skills_lint workflow stays green on this PR (matrix tests on ubuntu/macos/windows + coverage + pana ≥160).
After merge: cut tag dart_skills_lint-v0.4.0-dev.1 from main; confirm the new release workflow publishes a GitHub Release with all four tarballs + SHA256SUMS + install.sh.
In a clean Ubuntu container without Dart: `curl -fsSL .../install.sh | bash && dart_skills_lint --help` exits 0.
On macOS arm64: run `install.sh`, apply the documented `xattr -d com.apple.quarantine` workaround, confirm `dart_skills_lint --help` works.
Direct-download path (curl + SHA256 verification + tar + install) works as documented in README.
Pub.dev install paths still work unchanged (`dart pub global activate dart_skills_lint`).

- New tag-triggered release workflow builds dart_skills_lint as a standalone native binary for macOS arm64/x64 and Linux x64/arm64 via `dart compile exe`, packages each as a tarball with SHA256, and cuts a GitHub Release with release notes extracted from CHANGELOG.md. - New install.sh detects OS/arch, downloads the matching tarball, verifies SHA256, and installs to INSTALL_DIR (default /usr/local/bin with sudo fallback). REPO/VERSION/INSTALL_DIR are env-configurable so the script survives the impending dart_skills_lint repo move with a single default-value edit. - Pub.dev install paths (`dart pub global activate` and dev_dependency) are unchanged; binaries are a parallel channel. - macOS binaries in this preview are unsigned. Homebrew formula is deferred until the new home repo is settled to avoid forcing early adopters through a re-tap on migration.

- actions/upload-artifact: v4 → v7 (was the Node 20 deprecation warning source from the first fork test) - actions/download-artifact: v4 → v8 - softprops/action-gh-release: v2 → v3 All three were on Node 20, which GitHub forces to Node 24 on 2026-06-16. Each matrix job uploads with a unique artifact name, so v5+'s duplicate-name restriction is non-issue. download-artifact v8's new error-on-hash-mismatch default is a security upgrade.

Lead with install.sh as the recommended path; add a direct-curl variant for environments that don't pipe scripts to bash. Keep the pub.dev paths (dev_dependency and `dart pub global activate`) unchanged under a "Dart developers" section. Documents the macOS Gatekeeper workaround for unsigned preview binaries, a brief note that Homebrew is coming after the imminent repo migration, and the pinning syntax to opt into the preview track. Bumps the stable caret range example from ^0.2.0 to ^0.3.0.

gemini-code-assist

Code Review

This pull request introduces a native binary distribution channel for the dart_skills_lint tool (version 0.4.0-dev.1), adding a new installation script (install.sh), updating the README and CHANGELOG, and bumping the package version. The review feedback highlights two important improvements for the installation script: first, handling macOS Gatekeeper blocks gracefully during the post-install verification step so that the troubleshooting instructions are actually displayed to the user; second, making the SHA256 checksum verification more robust by stripping potential binary mode indicators (like *) from the checksum file fields.

gemini-code-assist · 2026-06-12T00:33:27Z

+"$install_path" --help >/dev/null 2>&1 \
+  || err "installed binary at ${install_path} failed to launch."


If the preview binary is blocked by macOS Gatekeeper, running "$install_path" --help will fail and trigger the || err ... block, causing the script to exit immediately. As a result, the user will never see the Gatekeeper troubleshooting note printed at the end of the script. Handling the verification failure gracefully on macOS and printing the troubleshooting instructions directly on failure ensures a much better user experience.

Suggested change

"$install_path" --help >/dev/null 2>&1 \

|| err "installed binary at ${install_path} failed to launch."

if ! "$install_path" --help >/dev/null 2>&1; then

if [ "$os" = "macos" ]; then

echo "install.sh: error: installed binary at ${install_path} failed to launch." >&2

echo "This is likely because the preview binary is not yet code-signed and is blocked by macOS Gatekeeper." >&2

echo "To fix this, run:" >&2

echo " xattr -d com.apple.quarantine \"${install_path}\"" >&2

exit 1

else

err "installed binary at ${install_path} failed to launch."

fi

fi

Fixed in 76ff632. The Gatekeeper note now prints before the --help smoke test so users always see the xattr -d com.apple.quarantine instruction even when the launch is blocked. On macOS specifically, a failed --help is downgraded from a hard error to an informational message since the install itself succeeded — the launch will work once quarantine is cleared. Non-macOS still hard-errs on launch failure (catches real issues like glibc mismatch).

gemini-code-assist · 2026-06-12T00:33:27Z

+  || err "could not download ${sums_url}"
+
+# --- Verify SHA256 ----------------------------------------------------------
+expected_sha="$(awk -v fname="$archive" '$2 == fname { print $1; exit }' "${tmpdir}/SHA256SUMS")"


The current awk pattern matching $2 == fname can fail if the SHA256SUMS file contains a binary mode indicator prefix (like *) before the filename (e.g., da39a3ee... *dart_skills_lint-linux-x64.tar.gz). Stripping any leading * from the second field makes the verification more robust across different platforms and tools.

Suggested change

expected_sha="$(awk -v fname="$archive" '$2 == fname { print $1; exit }' "${tmpdir}/SHA256SUMS")"

expected_sha="$(awk -v fname="$archive" '{ sub(/^\\*/, "", $2); if ($2 == fname) { print $1; exit } }' "${tmpdir}/SHA256SUMS")"

Fixed in 76ff632. The awk now strips any leading * from field 2 before the filename comparison, so SHA256SUMS files in either text or binary mode (sha256sum -b) work. Verified locally against both forms — input abc123 file and def456 *file both correctly extract the hash.

- install.sh:118 (high): print the macOS Gatekeeper note BEFORE the --help launch check so users see the xattr workaround even when Gatekeeper blocks the binary. On macOS, downgrade the --help failure from a hard err to an informational message since the install itself succeeded; the launch will work once quarantine is cleared. Non-macOS still hard-errs on launch failure. - install.sh:80 (medium): strip leading '*' from SHA256SUMS field 2 before comparison so binary-mode hash files (sha256sum -b output) work as well as text-mode.

reidbaker · 2026-06-12T19:57:18Z

+case "$(uname -m)" in
+  arm64|aarch64) arch="arm64" ;;
+  x86_64|amd64)  arch="x64" ;;
+  *)             err "unsupported architecture '$(uname -m)'. Supported: arm64, aarch64, x86_64, amd64." ;;


is aarch64 the correct thing here?

They are the same thing. I believe aarch64 is what linux will report, arm64 is what mac will report.

reidbaker · 2026-06-12T19:57:43Z

+
+# --- Detect platform ---------------------------------------------------------
+case "$(uname -s)" in
+  Darwin) os="macos" ;;


For each of these cases pull the supported list from the checked list.

reidbaker · 2026-06-12T19:59:53Z

+will not auto-pick this up; pin explicitly (`dart_skills_lint: 0.4.0-dev.1`)
+to try the preview.
+
+### Distribution


Here and below is way to long follow the structure of the change logs below and keep it focused on user facing changes/benefits.

reidbaker · 2026-06-12T20:00:56Z

+
+On macOS, replace `sha256sum -c -` with `shasum -a 256 -c -`.
+
+### 3. Dart developers — pub.dev


Make the dart developers section first.

- install.sh: collapse three hand-rolled "Supported: ..." messages behind one SUPPORTED_TARGETS constant, so the error text and the final platform check share a source of truth. Error text now lists normalized targets (macos-arm64, macos-x64, linux-x64, linux-arm64) instead of raw uname variants. - CHANGELOG.md: shrink the 0.4.0-dev.1 entry to match the 0.3.1 style — flat user-facing bullets, no internal workflow detail or Homebrew roadmap. - README.md: reorder the Installation section so the pub.dev path (existing Dart audience) comes first, followed by install.sh and the direct-download path for the no-Dart preview audience.

…rror coverage

jtmcdole · 2026-06-17T15:36:09Z

+        env:
+          VERSION: ${{ steps.meta.outputs.version }}
+
+      - name: Create GitHub Release


For a v0.5:

We can mark releases as immutable. Github will make the sha256 for us. Binaries cannot change.

It means we upload all binaries in the release step like this.

- name: Create Immutable GitHub Release env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | gh release create ${{ github.ref_name }} ./all-assets/* \ --title "Release ${{ github.ref_name }}" \ --generate-notes

reidbaker added 3 commits June 11, 2026 19:51

gemini-code-assist Bot reviewed Jun 12, 2026

View reviewed changes

reidbaker marked this pull request as draft June 12, 2026 00:56

reidbaker commented Jun 12, 2026

View reviewed changes

reidbaker mentioned this pull request Jun 17, 2026

Add windows support for binary install #164

Open

mboetger approved these changes Jun 17, 2026

View reviewed changes

reidbaker added 2 commits June 17, 2026 11:26

Refactor install.sh tests to be robust, add Linux tests and missing e…

3130b34

…rror coverage

Fix custom linter warnings and format test file

c82236f

reidbaker marked this pull request as ready for review June 17, 2026 15:29

Fix omit_obvious_local_variable_types analyzer warning in test

20fbf39

jtmcdole reviewed Jun 17, 2026

View reviewed changes

Comment thread .github/workflows/dart_skills_lint_release.yaml Outdated

jtmcdole approved these changes Jun 17, 2026

View reviewed changes

reidbaker added 3 commits June 17, 2026 13:13

Pin softprops/action-gh-release to commit SHA to resolve review feedback

ef84751

Pin VeryGoodOpenSource/very_good_coverage to commit SHA

83d4c2d

Add tag mapping comments to pinned action commit SHAs

e578b30

reidbaker merged commit 12de4eb into flutter:main Jun 17, 2026
13 checks passed

reidbaker deleted the binary-distribution-preview branch June 17, 2026 18:27

reidbaker mentioned this pull request Jun 17, 2026

Support Immutable GitHub Releases #165

Open

		"$install_path" --help >/dev/null 2>&1 \
		\|\| err "installed binary at ${install_path} failed to launch."

-"$install_path" --help >/dev/null 2>&1 \
-  || err "installed binary at ${install_path} failed to launch."
+if ! "$install_path" --help >/dev/null 2>&1; then
+  if [ "$os" = "macos" ]; then
+    echo "install.sh: error: installed binary at ${install_path} failed to launch." >&2
+    echo "This is likely because the preview binary is not yet code-signed and is blocked by macOS Gatekeeper." >&2
+    echo "To fix this, run:" >&2
+    echo "    xattr -d com.apple.quarantine \"${install_path}\"" >&2
+    exit 1
+  else
+    err "installed binary at ${install_path} failed to launch."
+  fi
+fi

	expected_sha="$(awk -v fname="$archive" '$2 == fname { print $1; exit }' "${tmpdir}/SHA256SUMS")"
	expected_sha="$(awk -v fname="$archive" '{ sub(/^\\*/, "", $2); if ($2 == fname) { print $1; exit } }' "${tmpdir}/SHA256SUMS")"


		On macOS, replace `sha256sum -c -` with `shasum -a 256 -c -`.

		### 3. Dart developers — pub.dev

Uh oh!

Conversation

reidbaker commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test plan

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

reidbaker commented Jun 12, 2026 •

edited

Loading