🚀🧑‍💻 - 1.5.3 - Repair nested SDK setup before pub.dev publication #175

Release Type

Patch

Release Version

1.5.3

Changelog

• Fix nested publication SDK setup by disabling its optional analyzer problem matcher. Preserve fresh OIDC credentials for every package and all publication dry runs.
• Add regression coverage for an inherited composite action path with no matcher asset, including failure before any package upload.
• Retain the accepted publisher, checkout, Apple host cleanup and Android emulator-session fixes from production 1.5.2; regenerate all distributable outputs during deployment preparation.
• Document recovery from a tagged workflow that failed before its first package upload.
• Minimum SDKs remain Dart ^3.12.0 and Flutter >=3.44.0; validation uses Flutter 3.47.2.

Additional Context

The maintainer explicitly authorized preparing, merging and publishing patch 1.5.3 through Copilot, preserving Copilot and the existing v1.5.1 and v1.5.2 tags. This authorization includes the normal lifecycle start, supported synchronization, deployment preparation, protected production promotion, protected pub.dev approval and configured development reconciliation for this new version.

Historical publication evidence:

• 1.5.1: issue 🚀🧑‍💻 - 1.5.1 - Prepare patch release with complete deployment built artifacts #168 / PR release(1.5.1): promote to master #169, immutable tag v1.5.1 at 804c1a8. Six packages were published; retain their immutable versions and hashes.
• 1.5.2: issue 🚀🧑‍💻 - 1.5.2 - Release recover package publication safely #170 / PR release(1.5.2): promote to master #174, accepted production and immutable tag v1.5.2 at aca7c11. Its candidate 7f4425b passed all 58 technical PR checks. Publication https://github.com/vypdev/zstandard/actions/runs/40430400481 failed before the first package command: nested setup-dart@v1 registers dart-analyzer.json against the parent publish-package action path, where the asset does not exist. Public API verification confirms zero of ten 1.5.2 packages and no GitHub Release 1.5.2.

The reviewed correction changes only .github/actions/publish-package/action.yml, its publication fixture and docs/deployment/RUNBOOK.md. It adds problem-matcher: false to the nested SDK invocation. Five publication tests pass; two additional isolated cases execute the actual official setup-dart@v1 compiled module and reproduce the failing default versus successful false input. SDK cache, network and OIDC are mocked in those two cases, with no real credentials or uploads. Patch SHA256: ef9e7757e4a055369ccc308b127914592b74855b4e2f05034561a6a9d874f494.

After Copilot creates and verifies this issue's managed branch, use its supported synchronization from master to retain aca7c11 and all production fixes. Apply the reviewed correction on that exact branch. No manually created, renamed, synchronized, deleted or force-pushed remote refs.

Copilot must update versions and changelogs, regenerate WebAssembly, compile all CLI native libraries, validate one exact candidate, retain a new successful attestation and perform protected production promotion before tagging and publishing 1.5.3. Do not reuse the 1.5.2 attestation, compile distributables locally or upload packages locally.

Keep Copilot engine/generated workflows/profile, credentials and PR_APPROVAL_POLICY intact. Every external Action uses a version tag such as @v1, never a literal commit pin. Preserve the historical blocked operations and both old tags; do not repeat the consumed premerge state-retirement exception or mark either previous version as fully published.