[efraespada]

Release preparation could fail to resolve the Linux ARM64 toolchain or retry unchanged native outputs, and publication ended outside Copilot's deployment lifecycle. This change builds and tests one exact candidate, then requires accepted production content and successful preparation evidence before package publication.

Closes #162.

Changes

• Pin sequential native builds and candidate checks to explicit commits; fix CMake paths and allow unchanged binary retries.
• Verify the accepted promotion, durable operation, candidate tree and successful CI receipt before OIDC. Retry publication only for the same immutable tag; notify Copilot after all ten package versions and checksums are verified.
• Use the installed Copilot callbacks for promotion, tagging, release creation and reconciliation. Retire the competing integration workflow.
• Honor MAIN_BRANCH and RELEASE_TREE consistently. Real Git tests reject tags accepted only on an unrelated default branch and preserve the GitHub-only hotfix lane.
• Fix observed CI timeouts: two minutes for each unchanged 100-case Android roundtrip batch and ten minutes for a fresh iOS simulator boot. All assertions and actual simulator readiness remain required; diagnostics and cleanup are bounded.
• Reuse the SDK in each persistent runner's versioned tool directory. Disable redundant remote SDK archives that spent tens of minutes transferring about 2 GB per Apple job.
• Pin external actions in modified workflows/composites to verified official commit SHAs, retaining their major versions.

Copilot's configuration, guidance, internal workflows, verification setup, hotfix workflow and vypdev/copilot@v3 references are unchanged. Package versions are unchanged.

Validation for 59369d9

• 31 release preparation, build, tag and evidence contract tests.
• Four simulator ownership and failure tests.
• Required Pull Request Safety Gate, including metadata/artifact checks, formatting, analysis, tests and coverage thresholds.
• Copilot review completed; both observations addressed and all review threads resolved.
• All platform integration matrices completed for this revision: Android modern/legacy, iOS/macOS SwiftPM/CocoaPods, Linux, Windows and web; workspace and pub-cache variants passed.
• Human maintainer review requested by Copilot for protected workflow changes.

Both Android integration files also pass local Dart analysis and formatting. Shell syntax and actionlint checks pass. actionlint 1.7.12 uses a narrow exception for its unsupported concurrency.queue parser rule; the installed Copilot queue contract is retained.

Publication readiness

On 2026-10-25 the maintainer confirmed GitHub-only automated publishing for all ten packages: repository vypdev/zstandard, tag pattern v{{version}}, required environment pub.dev. GitHub environment approval and branch/tag protections were configured separately. This is configuration evidence; no live OIDC publishing operation has been run.

No merge, repository version tag, GitHub release or package publication has been performed. A future release still requires the explicitly authorized Copilot deployment operation and environment approval.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/zstandard~163

Documentation is deployed and generated using docs.page

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.36%. Comparing base (ba72a2e) to head (59369d9).
⚠️ Report is 20 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff              @@
##           develop     #163       +/-   ##
============================================
+ Coverage    54.10%   77.36%   +23.26%     
============================================
  Files           12       14        +2     
  Lines          573     1109      +536     
============================================
+ Hits           310      858      +548     
+ Misses         263      251       -12     

Flag	Coverage Δ
cli	76.61% <ø> (+26.91%)	⬆️
platform_interface	85.71% <ø> (ø)
zstandard	88.33% <ø> (+1.29%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[vypbot]

Bugbot: review complete

Current status: No active findings on 59369d9.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 3/3 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 59369d9c23a1; base: c6f0c6d1582a; reason: protected-path.

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 59369d9. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit fac7e9d was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: Release tag validation ignores the configured production branch — scripts/check_release_tag.sh:17

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 59369d9. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit acf1d54 was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: Pin the newly added checkout action to a commit SHA — .github/workflows/release_workflow.yml:790