Mwc dnix

.gitattributes

@@ -1,4 +1,5 @@
-# Source fingerprints must be identical on Windows and Unix checkouts.
+# Line endings stay LF on every checkout, Windows included, so every host
+# builds from the same bytes.
 hook/** text eol=lf
 rust/src/** text eol=lf
 rust/Cargo.toml text eol=lf

.github/workflows/native.yml

@@ -0,0 +1,25 @@
+# Builds the Rust library on every reference host, fails if any host or the
+# committed dnix.lock disagrees, and publishes the release the lock names
+# when it reaches the default branch.
+name: Native library
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: write
+
+# A newer push supersedes runs on a branch, never on main: a run there may
+# be publishing.
+concurrency:
+  group: native-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != format('refs/heads/{0}', github.event.repository.default_branch) }}
+
+jobs:
+  native:
+    # The same dnix commit as pubspec.yaml and flake.lock.
+    uses: cypherstack/dnix/.github/workflows/native.yml@e91763ef25d084b3a5cf271a0cfee69159b1f779
+    with:
+      macos-runner: xcode-27

.github/workflows/tests.yml

@@ -0,0 +1,60 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  flutter:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, xcode-27, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        with:
+          flutter-version: 3.47.2
+          channel: stable
+          cache: true
+      # The hook builds through the Nix flake; before the first native
+      # release that is the only path, and it is unavailable on Windows.
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
+        if: runner.os != 'Windows'
+      - run: flutter pub get
+      - run: dart analyze hook tool test
+      # Prebuilt libraries exist once the lock's release is published from the
+      # default branch of the repository dnix.json names; until then only
+      # hosts with Nix can build them.
+      - name: Check whether the lock's release is published
+        id: release
+        shell: bash
+        run: |
+          repository=$(jq -r .repository dnix.json | sed 's/\.git$//; s#/$##')
+          tag="native-$(jq -r .release dnix.lock)"
+          echo "published=$([ "$(curl -s -o /dev/null -w '%{http_code}' "$repository/releases/tag/$tag")" = 200 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+      - name: Choose the build mode
+        shell: bash
+        run: echo '${{ steps.release.outputs.published == 'true' && 'prebuilt' || 'source' }}' > .dnix-build
+      - name: Run flutter test
+        if: runner.os != 'Windows' || steps.release.outputs.published == 'true'
+        shell: bash
+        run: |
+          if ! flutter test 2>&1 | tee test.log; then
+            echo "::error::$(tail -c 1500 test.log | tr '\n' ' ')"
+            exit 1
+          fi
+

.gitignore

@@ -28,3 +28,6 @@ migrate_working_dir/
 .dart_tool/
 .packages
 build/
+
+# Per-checkout dnix build mode override (see README).
+.dnix-build

CHANGELOG.md

@@ -1,3 +1,16 @@
+## Unreleased
+
+* **Breaking change:** the native library now comes from
+  [dnix](https://github.com/cypherstack/dnix). By default the build hook
+  downloads the library of the release `dnix.lock` names and verifies its
+  SHA-256; with the `build` user define set to `source` it builds the same
+  library with Nix, on Linux or an Apple Silicon Mac. The `native_build`,
+  `prebuilt_manifest_url` and `prebuilt_manifest_sha256` user defines are
+  no longer read: pinning this package's commit pins its libraries.
+* Every change is built on four hosts, which must produce the bytes
+  `dnix.lock` records; the default branch publishes the release it names.
+* A Linux arm64 library, which before could only be built from source.
+
 ## 0.0.1
 
 * TODO: Describe initial release.