[efraespada]

Flutter 3.47.2 can launch an iOS simulator app before its log stream is ready, lose the one-time Dart VM service URL, and wait until the watchdog expires. Develop's SwiftPM/pub-cache integration consequently built and installed the app but executed no tests.

Closes #164.

Changes

• Backport Flutter's official simulator log-readiness fix and regression tests from flutter/flutter#193142 into a disposable, revision-checked Flutter 3.47.2 SDK. Keep the shared SDK unchanged; rebuild the private tool snapshot and remove only the job's marked directory.
• Apply the same iOS SDK preparation to platform CI and future release-candidate validation. Preserve all four SwiftPM/CocoaPods and workspace/pub-cache variants, test assertions, simulator ownership and the 900-second watchdog.
• Use a private Gradle home and explicitly select the CI JDK 17 for Android builds. Both legacy variants previously failed while loading Flutter's Gradle plugin, including a retry. Keep AGP 9.1/Gradle 9.3.1 and legacy AGP 8.11.1/Gradle 8.14; isolate candidate consumers separately and collect a full Gradle stack trace on configuration failure.
• Require version tags such as @v1, @v2 and @v3 for remote Actions in workflows and composites. Replace 39 SHA references and validate all 235 current references. This follows the maintainer's explicit policy; the SHA-pinning review recommendation was dismissed on that basis.

Copilot configuration, guidance, internal workflows, verification setup, hotfix workflow and all vypdev/copilot@v3 references are unchanged.

Validation

Revision: 19c31f2603897147295b8f32ae706de2fcd890f7.

• All 53 upstream Flutter simulator tests, including three delayed-log-stream regressions; four simulator ownership tests and six cleanup protection tests.
• iOS: all four integration variants, including the previously blocked SwiftPM/pub-cache case.
• macOS: all four integration variants.
• Linux, Windows, web, CLI, platform interface, native and main-package checks.
• SDK simulator contract, release preparation and Action version-tag contract, and required safety gate.
• Android: all four integration variants, including both previously failing legacy variants, with actual Flutter and native instrumentation tests.
• Shell syntax, clean diff whitespace, Action version policy and actionlint. actionlint 1.7.12 retains only the existing narrow parser exception for Copilot's concurrency.queue; its queue contract is unchanged.
• Post-merge CI on develop: all 40 checks and all 10 workflows passed, including the four Android and four iOS integration variants. Copilot completed PR closure and closed issue 🐛🧑‍💻 - Fix iOS SwiftPM pub cache integration startup on develop #164.

Merged normally into develop after all technical CI passed. No version changes, deployment labels, tags, releases or publication are part of this work.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.36%. Comparing base (f37190a) to head (19c31f2).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #165   +/-   ##
========================================
  Coverage    77.36%   77.36%           
========================================
  Files           14       14           
  Lines         1109     1109           
========================================
  Hits           858      858           
  Misses         251      251           

Flag	Coverage Δ
cli	76.61% <ø> (ø)
platform_interface	85.71% <ø> (ø)
zstandard	88.33% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[vypbot]

Bugbot: review complete

Current status: No active findings on 19c31f2.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: This pull request is outside the configured approval scope.
Completed: 3/3 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 19c31f260389; base: f37190aa12c9; reason: scope.

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 19c31f2. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit e825984 was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• high: Mutable action tags are accepted in the OIDC publishing job — .github/scripts/check_action_versions.py:34