ci.yml

name: CI

# Single workflow for both branch/PR validation and tagged-release publish.
# - push to any branch / PR / workflow_dispatch → build all 4 platforms, upload artifacts
# - tag push (v*.*.*)                           → build + attach artifacts to GitHub Release

on:
  push:
    branches: ['**']
    tags: ['v*.*.*']
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build-linux:
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            arch: x86_64
            cmake_arch: linux-x86_64
          - runner: ubuntu-24.04-arm
            arch: aarch64
            cmake_arch: linux-aarch64
    runs-on: ${{ matrix.runner }}
    # Built inside the oldest distro flet supports — debian:10, glibc 2.28, matching
    # the lowest tier of flet's client build matrix (manylinux_2_28). The .so is linked
    # directly into end users' app executables at `flet build linux` time, so the glibc
    # it binds sets the floor for every machine that builds or runs a flet Linux app.
    # Building straight on a modern runner would raise that floor (e.g. glibc >= 2.38
    # binds __isoc23_* symbol versions and breaks Ubuntu 22.04 LTS; even glibc 2.35
    # binds pthread_create@GLIBC_2.34). A 2.28 floor covers Debian 10/11/12,
    # Ubuntu 20.04/22.04/24.04, and RHEL 8+ with a single artifact per arch.
    container:
      image: debian:10
    steps:
      # Debian 10 (buster) is EOL: its packages moved off the regular mirrors
      # to archive.debian.org, and the archived Release files' validity dates
      # have expired (hence Check-Valid-Until off). git + ca-certificates must
      # be installed before actions/checkout — the action runs inside this
      # container and needs them.
      - name: Point apt at the Debian 10 archive (EOL distro)
        shell: bash
        run: |
          printf '%s\n' \
            'deb http://archive.debian.org/debian buster main' \
            'deb http://archive.debian.org/debian buster-updates main' \
            'deb http://archive.debian.org/debian-security buster/updates main' \
            > /etc/apt/sources.list
          echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99no-check-valid-until
          apt-get update
          apt-get install -y build-essential curl ca-certificates git unzip file

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      # Debian 10's apt ships CMake 3.13 — below dart-bridge's `cmake_minimum_required(3.15)`
      # (and the local-dev fallback `find_package(Python3 COMPONENTS Development.Module)`
      # path needs 3.18+). Kitware's official binary tarballs are built against old
      # glibc, so a current CMake runs fine on buster.
      - name: Install modern CMake
        shell: bash
        run: |
          set -euo pipefail
          CMAKE_VER=3.31.6
          curl -fL -o cmake.tar.gz \
            "https://github.com/Kitware/CMake/releases/download/v${CMAKE_VER}/cmake-${CMAKE_VER}-${{ matrix.cmake_arch }}.tar.gz"
          tar -xzf cmake.tar.gz -C /opt
          echo "/opt/cmake-${CMAKE_VER}-${{ matrix.cmake_arch }}/bin" >> "$GITHUB_PATH"

      # We don't bundle Python — we only need Python.h and the abi3 stub
      # libpython3.so to link against, so the artifact's DT_NEEDED stays
      # version-agnostic (one binary for every CPython 3.12+).
      - name: Download python-linux-dart for abi3 link target
        shell: bash
        run: |
          set -euo pipefail
          PYVER=3.12   # any 3.12+ works; we only need headers + abi3 stub libpython3.so
          curl -fL -o pyld.tar.gz \
            "https://github.com/flet-dev/python-build/releases/download/v${PYVER}/python-linux-dart-${PYVER}-${{ matrix.arch }}.tar.gz"
          mkdir -p pydist && tar -xzf pyld.tar.gz -C pydist
          echo "DART_BRIDGE_PYTHON_INCLUDE_DIRS=$PWD/pydist/include/python${PYVER}" >> "$GITHUB_ENV"
          echo "DART_BRIDGE_PYTHON_LIBRARIES=$PWD/pydist/lib/libpython3.so" >> "$GITHUB_ENV"

      # Plain Release build; the two -D vars point CMake at the headers and
      # stub downloaded above (skipping the local-dev find_package fallback).
      - name: Configure + build
        shell: bash
        run: |
          cmake -B build -S . -DCMAKE_BUILD_TYPE=Release \
            -DDART_BRIDGE_PYTHON_INCLUDE_DIRS="${DART_BRIDGE_PYTHON_INCLUDE_DIRS}" \
            -DDART_BRIDGE_PYTHON_LIBRARIES="${DART_BRIDGE_PYTHON_LIBRARIES}"
          cmake --build build --parallel

      # Dart hosts load this library to EMBED Python, so libpython must be in
      # DT_NEEDED — unlike a Python extension module, where the interpreter
      # already provides the symbols. Guards against the linking mistake
      # where the .so builds fine but Py_Initialize crashes at dlopen time.
      - name: Verify DT_NEEDED includes libpython3.so
        shell: bash
        run: |
          set -euo pipefail
          NEEDED=$(readelf -d build/libdart_bridge.so | grep NEEDED || true)
          echo "$NEEDED"
          echo "$NEEDED" | grep -q "libpython3.so" || \
            { echo "ERROR: libdart_bridge.so is missing libpython3.so in DT_NEEDED"; exit 1; }

      # The real compatibility contract: the artifact must not reference any
      # glibc symbol newer than 2.28 (flet's lowest supported tier). This is
      # what a container bump would silently break — fail loudly instead.
      - name: Verify glibc floor is at most 2.28
        shell: bash
        run: |
          set -euo pipefail
          MAX=$(objdump -T build/libdart_bridge.so | grep -oE 'GLIBC_2\.[0-9]+' | sort -V | tail -1)
          echo "max versioned glibc symbol: ${MAX:-none}"
          HIGHEST=$(printf '%s\nGLIBC_2.28\n' "${MAX:-GLIBC_2.0}" | sort -V | tail -1)
          [ "$HIGHEST" = "GLIBC_2.28" ] || \
            { echo "ERROR: artifact requires $MAX (> 2.28); build container is too new"; exit 1; }

      # Arch-qualified filename: it's the exact name serious_python_linux's
      # CMake downloads from releases, and it lets multi-arch artifacts
      # coexist in caches and release pages.
      - name: Stage artifact with platform-tagged name
        shell: bash
        run: |
          mkdir -p dist
          cp build/libdart_bridge.so dist/libdart_bridge-linux-${{ matrix.arch }}.so
          file dist/libdart_bridge-linux-${{ matrix.arch }}.so
          ls -lh dist/

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: libdart_bridge-linux-${{ matrix.arch }}
          path: dist/libdart_bridge-linux-${{ matrix.arch }}.so
          if-no-files-found: error

  build-windows:
    runs-on: windows-2025-vs2026
    strategy:
      fail-fast: false
      matrix:
        # Release CRT = consumed by `flet build` / Release Flutter apps
        # Debug CRT  = consumed by `flutter run` / Debug Flutter apps
        config: [release, debug]
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Download python-windows-for-dart (headers + abi3 stub libs)
        shell: pwsh
        run: |
          $pyver = '3.12'  # any 3.12+ works; we only need headers + libs
          Invoke-WebRequest -Uri "https://github.com/flet-dev/python-build/releases/download/v$pyver/python-windows-for-dart-$pyver.zip" -OutFile pywin.zip
          Expand-Archive -Path pywin.zip -DestinationPath pywin -Force

      - name: Build dart_bridge.dll
        shell: pwsh
        run: |
          $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
          $vsPath = & $vswhere -latest -property installationPath
          $vcvars = "$vsPath\VC\Auxiliary\Build\vcvars64.bat"

          $includeDir = (Resolve-Path "pywin/include").Path
          $libDir = (Resolve-Path "pywin/libs").Path

          # Release / Debug variants:
          #   Release: /MD + python3.lib  → imports python3.dll
          #   Debug:   /MDd + python3_d.lib → imports python3_d.dll
          # /LIBPATH points at the same libs dir so pyconfig.h's auto-link
          # pragma (pythonXY(_d).lib) can resolve too.

          $outDir = "$PWD\dist"
          New-Item -ItemType Directory -Force -Path $outDir | Out-Null

          if ('${{ matrix.config }}' -eq 'debug') {
            $crt = '/MDd'
            $debugDef = '/D_DEBUG'
            $pyLib = "$libDir\python3_d.lib"
            $outName = 'dart_bridge_d-windows-x86_64.dll'
          } else {
            $crt = '/MD'
            $debugDef = ''
            $pyLib = "$libDir\python3.lib"
            $outName = 'dart_bridge-windows-x86_64.dll'
          }

          $clCmd = "cl /nologo /LD $crt $debugDef /DDART_SHARED_LIB /DPy_LIMITED_API=0x030c0000 /I `"$includeDir`" /I src src\dart_bridge.c src\serious_python_run.c src\dart_api\dart_api_dl.c /link /LIBPATH:`"$libDir`" /OUT:`"$outDir\$outName`" `"$pyLib`""
          cmd /c "`"$vcvars`" >NUL && $clCmd"

          if (-not (Test-Path "$outDir\$outName")) {
            throw "Build failed: $outName not produced"
          }
          Get-Item "$outDir\$outName" | Format-List FullName, Length

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: dart_bridge-windows-x86_64-${{ matrix.config }}
          path: |
            dist/dart_bridge-windows-x86_64.dll
            dist/dart_bridge_d-windows-x86_64.dll
          if-no-files-found: ignore

  build-android:
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        # Per-Python-version Android binaries. python-build-standalone's
        # libpython3.so on Linux/Android is a GNU linker script that
        # substitutes -lpython3.X at link time, so DT_NEEDED in the resulting
        # libdart_bridge.so is the version-specific libpython3.X.so. That
        # makes Android binaries inherently tied to one CPython version —
        # honest about that here with a matrix axis. python-build publishes
        # armeabi-v7a for every supported minor, so all ABIs build for all
        # versions.
        abi: [arm64-v8a, armeabi-v7a, x86_64]
        python_version: ['3.12', '3.13', '3.14']
    env:
      # python-build release the Android Python headers/libpython come from.
      # Keep in sync with serious_python's `pythonReleaseDate` — both link
      # these binaries against the same date-keyed CPython artifacts.
      PYTHON_BUILD_RELEASE_DATE: '20260629'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Download Python headers + libpython (python-android-mobile-forge)
        run: |
          set -euo pipefail
          VER=${{ matrix.python_version }}
          DATE="$PYTHON_BUILD_RELEASE_DATE"
          # Resolve the full CPython version for this minor from the pinned
          # date-keyed release's manifest (the single source of truth shared
          # with serious_python / flet), then pull that release's
          # mobile-forge artifact — which carries armeabi-v7a for every minor.
          curl -fL -o manifest.json \
            "https://github.com/flet-dev/python-build/releases/download/${DATE}/manifest.json"
          FULLVER=$(python3 -c "import json;print(json.load(open('manifest.json'))['pythons']['${VER}']['full_version'])")
          curl -fL -o pamf.tar.gz \
            "https://github.com/flet-dev/python-build/releases/download/${DATE}/python-android-mobile-forge-${FULLVER}.tar.gz"
          mkdir -p pydist
          # libpython3.so is the GNU linker script `INPUT(-lpython3.X)`;
          # extracting both lets ld follow the script to libpython3.X.so on
          # the link path. DT_NEEDED ends up as libpython3.X.so (the
          # version-specific one) — exactly what we want for the per-version
          # binary we're producing here.
          tar -xzf pamf.tar.gz -C pydist --wildcards \
            "install/android/${{ matrix.abi }}/python-${VER}.*/include/" \
            "install/android/${{ matrix.abi }}/python-${VER}.*/lib/libpython3.so" \
            "install/android/${{ matrix.abi }}/python-${VER}.*/lib/libpython${VER}.so"

      - name: Cross-compile libdart_bridge.so
        run: |
          set -euxo pipefail
          ABI=${{ matrix.abi }}
          VER=${{ matrix.python_version }}
          case "$ABI" in
            arm64-v8a)    TARGET=aarch64-linux-android ;;
            armeabi-v7a)  TARGET=armv7a-linux-androideabi ;;
            x86_64)       TARGET=x86_64-linux-android ;;
          esac
          API=21
          NDK="${ANDROID_NDK_HOME:-${ANDROID_NDK_LATEST_HOME}}"
          CC="$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/${TARGET}${API}-clang"

          INCLUDE_DIR=$(find pydist -path "*/include/python3.*" -type d | head -n1)
          LIBPYTHON=$(find pydist -name libpython3.so | head -n1)
          LIBPYTHON_DIR=$(dirname "$LIBPYTHON")
          test -n "$INCLUDE_DIR" -a -n "$LIBPYTHON"

          mkdir -p dist
          OUT="dist/libdart_bridge-android-${ABI}-py${VER}.so"

          $CC -shared -fPIC -fvisibility=hidden \
            -DDART_SHARED_LIB \
            -I "$INCLUDE_DIR" \
            -I src \
            src/dart_bridge.c src/serious_python_run.c src/dart_api/dart_api_dl.c \
            -L "$LIBPYTHON_DIR" \
            "$LIBPYTHON" \
            -ldl \
            -llog \
            -Wl,-z,max-page-size=16384 \
            -o "$OUT"

          file "$OUT"
          echo "DT_NEEDED entries (should include libpython${VER}.so):"
          $NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-readelf -d "$OUT" | grep NEEDED || true

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: libdart_bridge-android-${{ matrix.abi }}-py${{ matrix.python_version }}
          path: dist/libdart_bridge-android-${{ matrix.abi }}-py${{ matrix.python_version }}.so
          if-no-files-found: error

  # Unprivileged Apple build: no signing credentials are available here, so the
  # artifact it produces is UNSIGNED and deliberately not publishable. Skipped on
  # tags so a release run cannot possibly pick it up (see build-apple-signed).
  build-apple:
    if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Download Python iOS dist (headers)
        run: |
          set -euo pipefail
          VER=3.12  # abi3: any 3.12+ headers work
          curl -fL -o pyios.tar.gz \
            "https://github.com/flet-dev/python-build/releases/download/v${VER}/python-ios-dart-${VER}.tar.gz"
          mkdir -p pyios && tar -xzf pyios.tar.gz -C pyios
          # Find Python.h inside the extracted tree
          HEADER_DIR=$(find pyios -name Python.h -exec dirname {} \; | head -n1)
          echo "PYTHON_HEADERS_DIR=$HEADER_DIR" >> "$GITHUB_ENV"

      - name: Build xcframework
        run: ./apple/build_xcframework.sh

      - name: Inspect artifact
        run: |
          ls -la dist/
          du -sh dist/dart_bridge-apple.xcframework.zip

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: dart_bridge-apple-xcframework-unsigned
          path: dist/dart_bridge-apple.xcframework.zip
          if-no-files-found: error

  # Release-only Apple build. Isolated from the general matrix so the provider
  # certificate is never present in a PR or branch run: the `release-signing`
  # environment holds the secrets and can carry branch/tag protection rules.
  #
  # Xcode records the SDK-origin signature of every XCFramework an app links
  # against into the IPA's Signatures/ receipts. An unsigned dart_bridge makes
  # that receipt read `signed = false`, which Apple's scan reports as
  # ITMS-91065. Hence: no unsigned Apple artifact may ever reach a release.
  build-apple-signed:
    name: build-apple (provider-signed)
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    runs-on: macos-latest
    environment: release-signing
    env:
      XCFRAMEWORK_EXPECTED_TEAM_ID: ${{ vars.XCFRAMEWORK_EXPECTED_TEAM_ID }}
      # Turns every "credentials missing / signature not verifiable" case into a
      # build failure instead of a silent unsigned artifact.
      REQUIRE_XCFRAMEWORK_SIGNATURE: '1'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Download Python iOS dist (headers)
        run: |
          set -euo pipefail
          VER=3.12  # abi3: any 3.12+ headers work
          curl -fL -o pyios.tar.gz \
            "https://github.com/flet-dev/python-build/releases/download/v${VER}/python-ios-dart-${VER}.tar.gz"
          mkdir -p pyios && tar -xzf pyios.tar.gz -C pyios
          HEADER_DIR=$(find pyios -name Python.h -exec dirname {} \; | head -n1)
          echo "PYTHON_HEADERS_DIR=$HEADER_DIR" >> "$GITHUB_ENV"

      - name: Import Apple Distribution certificate into a temporary keychain
        env:
          CERT_P12_BASE64: ${{ secrets.APPLE_DISTRIBUTION_CERT_P12_BASE64 }}
          CERT_P12_PASSWORD: ${{ secrets.APPLE_DISTRIBUTION_CERT_P12_PASSWORD }}
        run: |
          set -euo pipefail
          : "${CERT_P12_BASE64:?APPLE_DISTRIBUTION_CERT_P12_BASE64 is not set}"
          : "${CERT_P12_PASSWORD:?APPLE_DISTRIBUTION_CERT_P12_PASSWORD is not set}"

          KEYCHAIN_PATH="$RUNNER_TEMP/xcframework-signing.keychain-db"
          CERT_PATH="$RUNNER_TEMP/xcframework-signing.p12"
          # Ephemeral: the keychain lives for this job only and is deleted in the
          # always-run cleanup step, so the password never needs to leave it.
          KEYCHAIN_PASSWORD=$(openssl rand -base64 24)

          printf '%s' "$CERT_P12_BASE64" | base64 --decode > "$CERT_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          # No -A: the private key is reachable only by the two Apple tools named
          # below, not by any process that happens to run in this job.
          security import "$CERT_PATH" -k "$KEYCHAIN_PATH" -P "$CERT_P12_PASSWORD" \
            -f pkcs12 -T /usr/bin/codesign -T /usr/bin/security
          security set-key-partition-list -S apple-tool:,apple: -s \
            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" >/dev/null

          # codesign resolves an identity through the search list even when
          # --keychain is passed, so prepend ours to the user list.
          security list-keychains -d user -s "$KEYCHAIN_PATH" \
            $(security list-keychains -d user | tr -d '"')

          # Derive EXACTLY ONE fingerprint. Selecting by display name is
          # ambiguous when a keychain holds more than one matching certificate,
          # and codesign then picks arbitrarily; a hard count check makes a
          # multi-certificate .p12 a build failure instead of a coin flip.
          IDENTITIES=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH")
          echo "$IDENTITIES"
          FPRS=$(printf '%s\n' "$IDENTITIES" \
                   | sed -n 's/^ *[0-9]*) \([0-9A-F]\{40\}\) .*/\1/p' | sort -u)
          COUNT=$(printf '%s' "$FPRS" | grep -c . || true)
          if [ "$COUNT" -ne 1 ]; then
            echo "::error::expected exactly 1 codesigning identity in the imported keychain, found $COUNT"
            exit 1
          fi

          # Fingerprint and keychain path are not secrets.
          echo "XCFRAMEWORK_CODESIGN_IDENTITY=$FPRS" >> "$GITHUB_ENV"
          echo "XCFRAMEWORK_SIGNING_KEYCHAIN=$KEYCHAIN_PATH" >> "$GITHUB_ENV"

      # build_xcframework.sh signs the completed xcframework, verifies it, zips
      # it, then extracts the zip into a fresh directory and verifies again.
      - name: Build + sign xcframework
        run: ./apple/build_xcframework.sh

      - name: Inspect artifact
        run: |
          ls -la dist/
          du -sh dist/dart_bridge-apple.xcframework.zip

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: dart_bridge-apple-xcframework-signed
          path: dist/dart_bridge-apple.xcframework.zip
          if-no-files-found: error

      - name: Remove temporary keychain and certificate
        if: always()
        run: |
          security delete-keychain "$RUNNER_TEMP/xcframework-signing.keychain-db" 2>/dev/null || true
          rm -f "$RUNNER_TEMP/xcframework-signing.p12"

  # Tag-gated publish: collects every build job's artifacts and attaches
  # them to a GitHub Release named after the pushed tag. Skipped for
  # branch / PR runs.
  publish:
    # build-apple-signed, never build-apple: the unsigned Apple job does not run
    # on tags at all, and depending on the signed job here means a signing
    # failure blocks the release rather than degrading it to an unsigned zip.
    needs: [build-linux, build-windows, build-android, build-apple-signed]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: artifacts

      - name: Flatten artifacts into one dir
        run: |
          set -euo pipefail
          mkdir -p dist

          # Belt and braces: build-apple is `if:`-skipped on tags, so an
          # unsigned Apple artifact should not exist in this run. If one somehow
          # does, fail rather than let the two same-named zips race for the same
          # destination filename.
          if [ -d artifacts/dart_bridge-apple-xcframework-unsigned ]; then
            echo "::error::an UNSIGNED Apple artifact is present in a release run; refusing to publish"
            exit 1
          fi
          if [ ! -f artifacts/dart_bridge-apple-xcframework-signed/dart_bridge-apple.xcframework.zip ]; then
            echo "::error::signed Apple artifact missing; refusing to publish"
            exit 1
          fi

          find artifacts -type f \( -name '*.so' -o -name '*.dll' -o -name '*.zip' \) -exec cp {} dist/ \;
          echo "=== Release payload ==="
          ls -lh dist/

      - name: Attach to GitHub Release
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          generate_release_notes: true
          files: |
            dist/libdart_bridge-linux-x86_64.so
            dist/libdart_bridge-linux-aarch64.so
            dist/dart_bridge-windows-x86_64.dll
            dist/dart_bridge_d-windows-x86_64.dll
            dist/libdart_bridge-android-arm64-v8a-py3.12.so
            dist/libdart_bridge-android-arm64-v8a-py3.13.so
            dist/libdart_bridge-android-arm64-v8a-py3.14.so
            dist/libdart_bridge-android-armeabi-v7a-py3.12.so
            dist/libdart_bridge-android-armeabi-v7a-py3.13.so
            dist/libdart_bridge-android-armeabi-v7a-py3.14.so
            dist/libdart_bridge-android-x86_64-py3.12.so
            dist/libdart_bridge-android-x86_64-py3.13.so
            dist/libdart_bridge-android-x86_64-py3.14.so
            dist/dart_bridge-apple.xcframework.zip
          fail_on_unmatched_files: true