From aecd0b1a28610eda4af0d9b9c599be90c5f41be6 Mon Sep 17 00:00:00 2001
From: Sem Van Broekhoven <144097969+dotsem@users.noreply.github.com>
Date: Thu, 12 Nov 2026 13:27:52 +0100
Subject: [PATCH 1/7] chore: remove node test fixtures

---
 tests/fixtures/clean.sarif         |  15 ---
 tests/fixtures/dirty.sarif         |  53 --------
 tests/fixtures/node/index.js       |   5 -
 tests/fixtures/node/package.json   |  22 ----
 tests/fixtures/node/pnpm-lock.yaml | 200 -----------------------------
 5 files changed, 295 deletions(-)
 delete mode 100644 tests/fixtures/clean.sarif
 delete mode 100644 tests/fixtures/dirty.sarif
 delete mode 100644 tests/fixtures/node/index.js
 delete mode 100644 tests/fixtures/node/package.json
 delete mode 100644 tests/fixtures/node/pnpm-lock.yaml

diff --git a/tests/fixtures/clean.sarif b/tests/fixtures/clean.sarif
deleted file mode 100644
index 792b929..0000000
--- a/tests/fixtures/clean.sarif
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
-  "version": "2.1.0",
-  "runs": [
-    {
-      "tool": {
-        "driver": {
-          "name": "Trivy Test Mock",
-          "rules": []
-        }
-      },
-      "results": []
-    }
-  ]
-}
diff --git a/tests/fixtures/dirty.sarif b/tests/fixtures/dirty.sarif
deleted file mode 100644
index d306a31..0000000
--- a/tests/fixtures/dirty.sarif
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
-  "version": "2.1.0",
-  "runs": [
-    {
-      "tool": {
-        "driver": {
-          "name": "Trivy Test Mock",
-          "rules": [
-            {
-              "id": "CVE-2026-0001",
-              "name": "MockCriticalVulnerability",
-              "defaultConfiguration": { "level": "error" }
-            },
-            {
-              "id": "CVE-2026-0002",
-              "name": "MockWarningVulnerability",
-              "defaultConfiguration": { "level": "warning" }
-            }
-          ]
-        }
-      },
-      "results": [
-        {
-          "ruleId": "CVE-2026-0001",
-          "level": "error",
-          "message": { "text": "Critical vulnerability detected in dependency" },
-          "locations": [
-            {
-              "physicalLocation": {
-                "artifactLocation": { "uri": "package.json" },
-                "region": { "startLine": 14 }
-              }
-            }
-          ]
-        },
-        {
-          "ruleId": "CVE-2026-0002",
-          "level": "warning",
-          "message": { "text": "Medium severity configuration warning" },
-          "locations": [
-            {
-              "physicalLocation": {
-                "artifactLocation": { "uri": "Dockerfile" },
-                "region": { "startLine": 1 }
-              }
-            }
-          ]
-        }
-      ]
-    }
-  ]
-}
diff --git a/tests/fixtures/node/index.js b/tests/fixtures/node/index.js
deleted file mode 100644
index 11d258d..0000000
--- a/tests/fixtures/node/index.js
+++ /dev/null
@@ -1,5 +0,0 @@
-import { writeFileSync } from "node:fs";
-
-// Record received CLI args so internal-test-node.yml can assert how build-node passes `args`
-writeFileSync("build-args.json", JSON.stringify(process.argv.slice(2)));
-console.log("Build completed successfully.");
diff --git a/tests/fixtures/node/package.json b/tests/fixtures/node/package.json
deleted file mode 100644
index 152b301..0000000
--- a/tests/fixtures/node/package.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-    "name": "node",
-    "version": "0.0.0",
-    "description": "",
-    "main": "index.js",
-    "scripts": {
-        "test": "echo \"Error: no test specified\" && exit 1",
-        "build": "node index.js"
-    },
-    "keywords": [],
-    "author": "",
-    "license": "ISC",
-    "devEngines": {
-        "packageManager": {
-            "name": "pnpm",
-            "version": "12.15.0",
-            "onFail": "download"
-        }
-    },
-    "packageManager": "pnpm@12.15.0",
-    "type": "module"
-}
diff --git a/tests/fixtures/node/pnpm-lock.yaml b/tests/fixtures/node/pnpm-lock.yaml
deleted file mode 100644
index 929a88d..0000000
--- a/tests/fixtures/node/pnpm-lock.yaml
+++ /dev/null
@@ -1,200 +0,0 @@
----
-lockfileVersion: "9.0"
-
-importers:
-  .:
-    configDependencies: {}
-    packageManagerDependencies:
-      pnpm:
-        specifier: 12.15.0
-        version: 12.15.0
-
-packages:
-  "@pnpm/exe.android-arm64@12.15.0":
-    resolution:
-      {
-        integrity: sha512-eVCqmscY70LGvgRzu3mi8IBWBFGix+a6mNZoWmXxESsBdeiKEF9xQSuaeel10yn+zI7TXy2jlI63vFLzETk+aQ==,
-      }
-    cpu: [arm64]
-    os: [android]
-
-  "@pnpm/exe.android-x64@12.15.0":
-    resolution:
-      {
-        integrity: sha512-Gx/WbkFcdUFUg8g8AShezcS9EiQxfYvdAm2hfKLO8sfJmJvKOCt5fzlgHWDzmGhoclibgW+tUGZ/KF4F4wOTCA==,
-      }
-    cpu: [x64]
-    os: [android]
-
-  "@pnpm/exe.darwin-arm64@12.15.0":
-    resolution:
-      {
-        integrity: sha512-N0ZykiDWCvqSBJvt71j7cSoBR993FqvYZFtmpCtqvW3pguiI+NAgraLPA5OTwu5mV+/d8hYpVcPktJA3xFDLtA==,
-      }
-    cpu: [arm64]
-    os: [darwin]
-
-  "@pnpm/exe.darwin-x64@12.15.0":
-    resolution:
-      {
-        integrity: sha512-7Ntr2HlBUxzwWOg7NwDxCbRW/3vXuqKO+hcXm+w3SBi9rrHY53li1wLqWVT7Gjxd+lVEHM1QJZo6WJEGFU8C6A==,
-      }
-    cpu: [x64]
-    os: [darwin]
-
-  "@pnpm/exe.freebsd-x64@12.15.0":
-    resolution:
-      {
-        integrity: sha512-btOiyL7fL7W4uQGH0aqFai2TNC3IoKcZ7gNHBVbEFZt2dWrnrD0SufL3iGs3fLlmb4OtuU35uf4Zpr9V9Jh9mA==,
-      }
-    cpu: [x64]
-    os: [freebsd]
-
-  "@pnpm/exe.linux-arm64-musl@12.15.0":
-    resolution:
-      {
-        integrity: sha512-pNC38k+O+90FOjbPNSnw0E7apq1PKTmz3fFe1amn+lys/U5kL++uzir8bRiho8ONcyA3d9EU7wdqcY0DKkj+JA==,
-      }
-    cpu: [arm64]
-    os: [linux]
-    libc: [musl]
-
-  "@pnpm/exe.linux-arm64@12.15.0":
-    resolution:
-      {
-        integrity: sha512-qML/8aCXslh8td/w4U+HJNqUcZ2+m6EfTbWScIzZRmyPsRFN+xB4LP1U/hymxc1iSJiKtG56HJx2fvUErWFIGw==,
-      }
-    cpu: [arm64]
-    os: [linux]
-    libc: [glibc]
-
-  "@pnpm/exe.linux-ppc64@12.15.0":
-    resolution:
-      {
-        integrity: sha512-tjRDUUl7RCJ6T/6eoNPxOqkwU4Mzi5RtTXmSAxujyz37OTwwsMU7Ps087Zk4gHcUvRSeyF40ZFsew3vtE+nmUA==,
-      }
-    cpu: [ppc64]
-    os: [linux]
-    libc: [glibc]
-
-  "@pnpm/exe.linux-riscv64@12.15.0":
-    resolution:
-      {
-        integrity: sha512-bF1uBWEfbwaeryz6lIiaJ8AWD082otZfvzGX5l+6LZRpRwUEpJHUsJrORaYP5/cNMv5ZR2p6TvvcJcQzwtDzmw==,
-      }
-    cpu: [riscv64]
-    os: [linux]
-    libc: [glibc]
-
-  "@pnpm/exe.linux-s390x@12.15.0":
-    resolution:
-      {
-        integrity: sha512-zKMhIzsexYMToeLmqV5jPsvV/f9vwsJb2kUH2NFYzalbxImeBrlA4kL7GwF8gD4pagV6jYYcJb8RjbZIdjHptg==,
-      }
-    cpu: [s390x]
-    os: [linux]
-    libc: [glibc]
-
-  "@pnpm/exe.linux-x64-musl@12.15.0":
-    resolution:
-      {
-        integrity: sha512-A9J0Jg0Rdx+qQU4qXtwyST5tto9IOu1zi4fDk35nbc6DWahggbcKtFvZPKFwL2qgUXGXOX//hXv6z/sp6emO8A==,
-      }
-    cpu: [x64]
-    os: [linux]
-    libc: [musl]
-
-  "@pnpm/exe.linux-x64@12.15.0":
-    resolution:
-      {
-        integrity: sha512-yc+QlZR+9+nr29J4fRzhMoapgxTBDndq/+peyoq1XUufnQFnfbXUMFudDIKzHi545linGqmOmXfn0NoufNgcOg==,
-      }
-    cpu: [x64]
-    os: [linux]
-    libc: [glibc]
-
-  "@pnpm/exe.win32-arm64@12.15.0":
-    resolution:
-      {
-        integrity: sha512-fPXZxuY1VclkOga9bc53qNCXcegfeoBR8+Ue+AospDwKzuGGSHll0oDxkLfkmpjyRqpe7bH5DyQPYp/xSMaIVA==,
-      }
-    cpu: [arm64]
-    os: [win32]
-
-  "@pnpm/exe.win32-x64@12.15.0":
-    resolution:
-      {
-        integrity: sha512-nrd+Tp1We1DGj4DGG5Bea9lZNh9y1PjlLBdEwdInS4D0h0UIDtM7JaGGGDJhNzIwcHASyihWI7HLV+dtG+fhYg==,
-      }
-    cpu: [x64]
-    os: [win32]
-
-  pnpm@12.15.0:
-    resolution:
-      {
-        integrity: sha512-s5UdbW/0qfE9x89WzSjSuOs328ycaOUuHhGRhz6p+CoBcoerULqtxczElPA2xnwOR+sTYIwvo29HcRth6hKOYQ==,
-      }
-    engines: { node: ">=18" }
-    hasBin: true
-
-snapshots:
-  "@pnpm/exe.android-arm64@12.15.0":
-    optional: true
-
-  "@pnpm/exe.android-x64@12.15.0":
-    optional: true
-
-  "@pnpm/exe.darwin-arm64@12.15.0":
-    optional: true
-
-  "@pnpm/exe.darwin-x64@12.15.0":
-    optional: true
-
-  "@pnpm/exe.freebsd-x64@12.15.0":
-    optional: true
-
-  "@pnpm/exe.linux-arm64-musl@12.15.0":
-    optional: true
-
-  "@pnpm/exe.linux-arm64@12.15.0":
-    optional: true
-
-  "@pnpm/exe.linux-ppc64@12.15.0":
-    optional: true
-
-  "@pnpm/exe.linux-riscv64@12.15.0":
-    optional: true
-
-  "@pnpm/exe.linux-s390x@12.15.0":
-    optional: true
-
-  "@pnpm/exe.linux-x64-musl@12.15.0":
-    optional: true
-
-  "@pnpm/exe.linux-x64@12.15.0":
-    optional: true
-
-  "@pnpm/exe.win32-arm64@12.15.0":
-    optional: true
-
-  "@pnpm/exe.win32-x64@12.15.0":
-    optional: true
-
-  pnpm@12.15.0:
-    optionalDependencies:
-      "@pnpm/exe.android-arm64": 12.15.0
-      "@pnpm/exe.android-x64": 12.15.0
-      "@pnpm/exe.darwin-arm64": 12.15.0
-      "@pnpm/exe.darwin-x64": 12.15.0
-      "@pnpm/exe.freebsd-x64": 12.15.0
-      "@pnpm/exe.linux-arm64": 12.15.0
-      "@pnpm/exe.linux-arm64-musl": 12.15.0
-      "@pnpm/exe.linux-ppc64": 12.15.0
-      "@pnpm/exe.linux-riscv64": 12.15.0
-      "@pnpm/exe.linux-s390x": 12.15.0
-      "@pnpm/exe.linux-x64": 12.15.0
-      "@pnpm/exe.linux-x64-musl": 12.15.0
-      "@pnpm/exe.win32-arm64": 12.15.0
-      "@pnpm/exe.win32-x64": 12.15.0
-
----

From 28471855316fb9bb3b2dac2f5df24745615cf862 Mon Sep 17 00:00:00 2001
From: Sem Van Broekhoven <144097969+dotsem@users.noreply.github.com>
Date: Thu, 12 Nov 2026 13:30:04 +0100
Subject: [PATCH 2/7] chore: update gitignore

---
 .gitignore | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index 5d1d311..33e8634 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,9 +1,5 @@
-node_modules/
-.pnpm-store/
 *.log
 .DS_Store
 Thumbs.db
 .dart_tool/
-**/build/
-**/ephemeral/
-build-args.json
+tests/fixtures/build/

From 71c8f835c38687b987e95f34be6689db72f922a5 Mon Sep 17 00:00:00 2001
From: Sem Van Broekhoven <144097969+dotsem@users.noreply.github.com>
Date: Thu, 12 Nov 2026 13:30:22 +0100
Subject: [PATCH 3/7] chore: remove prettierignore

---
 .prettierignore | 4 ----
 1 file changed, 4 deletions(-)
 delete mode 100644 .prettierignore

diff --git a/.prettierignore b/.prettierignore
deleted file mode 100644
index be0c97c..0000000
--- a/.prettierignore
+++ /dev/null
@@ -1,4 +0,0 @@
-node_modules/
-dist/
-**/dist/**
-pnpm-lock.yaml

From 45277f8a4e581d4823bab07faab3a44a863646af Mon Sep 17 00:00:00 2001
From: Sem Van Broekhoven <144097969+dotsem@users.noreply.github.com>
Date: Thu, 12 Nov 2026 13:31:01 +0100
Subject: [PATCH 4/7] docs(agents): update guidelines about breaking changes

---
 AGENTS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index a6255fd..0b1a1de 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -55,7 +55,7 @@ Opinionated composite actions and reusable workflows for building and shipping F
 
 ## Public API & Versioning
 
-- Inputs, outputs, input defaults, artifact names and reusable-workflow `with:`/`secrets:` are public API. Renaming, removing or changing the default of any of them is a **breaking change**: flag it explicitly in your response so the human can bump the major version.
+- Inputs, outputs, input defaults, artifact names and reusable-workflow `with:`/`secrets:` are public API. Renaming, removing or changing the default of any of them is a **breaking change**: flag it explicitly in your response so the human can bump the minor version (during `0.x`).
 - Every public input/output change must be reflected in `README.md` (tables + usage examples).
 - Releases are cut only by the human via the `Release` workflow (`internal-release.yml`). Never create or move tags.
 

From 0915c88b8926ecf368537e5a13ebf82848763fe6 Mon Sep 17 00:00:00 2001
From: Sem Van Broekhoven <144097969+dotsem@users.noreply.github.com>
Date: Thu, 12 Nov 2026 13:37:13 +0100
Subject: [PATCH 5/7] refactor(dependabot): remove npm dep

---
 .github/dependabot.yml | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 29538e3..df7cdaa 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,27 +18,3 @@ updates:
         patterns:
           - "*"
 
-  # Root Monorepo TypeScript & Action dependencies
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "04:00"
-      timezone: "UTC"
-    target-branch: "main"
-    open-pull-requests-limit: 10
-    cooldown:
-      default-days: 7
-    commit-message:
-      prefix: "chore(deps)"
-    groups:
-      tooling:
-        patterns:
-          - "typescript*"
-          - "tsup*"
-          - "@types/*"
-          - "prettier*"
-      actions:
-        patterns:
-          - "@actions/*"

From ebe4c13db87ca0b55fb64906c38f59c5da40b1a3 Mon Sep 17 00:00:00 2001
From: Sem Van Broekhoven <144097969+dotsem@users.noreply.github.com>
Date: Thu, 12 Nov 2026 13:40:00 +0100
Subject: [PATCH 6/7] refactor: change naming to new repo name & structure

---
 .github/workflows/internal-test.yml   |  79 ++++++++++-------
 build/action.yml                      |  53 +++++++-----
 build/scripts/package-android.sh      |   7 +-
 build/scripts/package-ios.sh          |   5 +-
 build/scripts/package-linux.sh        |   6 +-
 build/scripts/package-macos.sh        |   5 +-
 build/scripts/package-windows.ps1     |  11 ++-
 build/scripts/resolve-metadata.sh     |  22 +++--
 build/scripts/set-artifact-outputs.sh |   7 +-
 matrix/scripts/resolve-matrix.sh      |  11 ++-
 tests/fixtures/test/app_test.dart     |   7 ++
 tests/lib.sh                          | 118 --------------------------
 tests/package-android.test.sh         |  20 ++---
 tests/package-apple.test.sh           |  20 ++---
 tests/package-linux.test.sh           |  10 +--
 tests/package-windows.test.sh         |  12 +--
 tests/resolve-matrix.test.sh          |  13 +--
 tests/resolve-metadata.test.sh        |  37 +++++---
 tests/resolve-version.test.sh         |   6 +-
 tests/set-artifact-outputs.test.sh    |  26 +++---
 20 files changed, 221 insertions(+), 254 deletions(-)
 create mode 100644 tests/fixtures/test/app_test.dart
 delete mode 100644 tests/lib.sh

diff --git a/.github/workflows/internal-test.yml b/.github/workflows/internal-test.yml
index 2a14865..6d00027 100644
--- a/.github/workflows/internal-test.yml
+++ b/.github/workflows/internal-test.yml
@@ -1,34 +1,36 @@
-name: Test Flutter Action
+name: Test Flutter Actions
 
 on:
   pull_request:
     paths:
-      - "build-flutter/**"
-      - "setup-flutter/**"
-      - "flutter-matrix/**"
-      - ".github/workflows/flutter-*.yml"
-      - ".github/workflows/internal-test-flutter.yml"
-      - "tests/fixtures/flutter/**"
+      - "build/**"
+      - "setup/**"
+      - "matrix/**"
+      - ".github/workflows/ci.yml"
+      - ".github/workflows/cd.yml"
+      - ".github/workflows/internal-test.yml"
+      - "tests/fixtures/**"
   push:
     branches: [main]
     paths:
-      - "build-flutter/**"
-      - "setup-flutter/**"
-      - "flutter-matrix/**"
-      - ".github/workflows/flutter-*.yml"
-      - ".github/workflows/internal-test-flutter.yml"
-      - "tests/fixtures/flutter/**"
+      - "build/**"
+      - "setup/**"
+      - "matrix/**"
+      - ".github/workflows/ci.yml"
+      - ".github/workflows/cd.yml"
+      - ".github/workflows/internal-test.yml"
+      - "tests/fixtures/**"
   workflow_dispatch:
 
 permissions:
   contents: read
 
 concurrency:
-  group: test-flutter-${{ github.ref }}
+  group: internal-test-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
-  test-build-flutter:
+  test-build:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -40,50 +42,58 @@ jobs:
             expected-suffix: "-debug"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Test build-flutter (${{ matrix.build-mode }})
+      - name: Test build (${{ matrix.build-mode }})
         id: build-app
-        uses: ./build-flutter
+        uses: ./build
         with:
           target: "linux"
           build-mode: ${{ matrix.build-mode }}
-          working-directory: "tests/fixtures/flutter"
+          working-directory: "tests/fixtures"
       - name: Assert build artifacts and outputs
         shell: bash
         env:
           EXPECTED_NAME: "test_app-linux${{ matrix.expected-suffix }}"
+          ARTIFACT_NAME: ${{ steps.build-app.outputs.artifact-name }}
+          ARTIFACT_PATH: ${{ steps.build-app.outputs.artifact-path }}
         run: |
-          test -f "tests/fixtures/flutter/dist/${EXPECTED_NAME}.tar.gz"
-          tar -tzf "tests/fixtures/flutter/dist/${EXPECTED_NAME}.tar.gz" > /dev/null
-          if [ "${{ steps.build-app.outputs.artifact-name }}" != "$EXPECTED_NAME" ]; then
-            echo "Expected artifact-name '$EXPECTED_NAME', got '${{ steps.build-app.outputs.artifact-name }}'"
+          DIST_DIR="$RUNNER_TEMP/flutter-dist/linux"
+          test -f "$DIST_DIR/${EXPECTED_NAME}.tar.gz"
+          tar -tzf "$DIST_DIR/${EXPECTED_NAME}.tar.gz" > /dev/null
+          if [ "$ARTIFACT_NAME" != "$EXPECTED_NAME" ]; then
+            echo "Expected artifact-name '$EXPECTED_NAME', got '$ARTIFACT_NAME'"
             exit 1
           fi
-          if [ "${{ steps.build-app.outputs.artifact-path }}" != "tests/fixtures/flutter/dist/*" ]; then
-            echo "Expected artifact-path 'tests/fixtures/flutter/dist/*', got '${{ steps.build-app.outputs.artifact-path }}'"
+          if [ "$ARTIFACT_PATH" != "$DIST_DIR/*" ]; then
+            echo "Expected artifact-path '$DIST_DIR/*', got '$ARTIFACT_PATH'"
+            exit 1
+          fi
+          if [ -e tests/fixtures/dist ]; then
+            echo "Packaging must not write into the working directory"
             exit 1
           fi
 
-  test-setup-flutter-range:
+  test-setup-range:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Use a caret constraint in the fixture
         run: |
-          sed -i 's/^  flutter: .*/  flutter: ^3.47.1/' tests/fixtures/flutter/pubspec.yaml
-      - uses: ./setup-flutter
+          sed -i 's/^  flutter: [0-9].*/  flutter: ^3.47.1/' tests/fixtures/pubspec.yaml
+          grep -qx '  flutter: ^3.47.1' tests/fixtures/pubspec.yaml
+      - uses: ./setup
         with:
-          working-directory: "tests/fixtures/flutter"
+          working-directory: "tests/fixtures"
       - name: Assert lower bound was installed
         run: flutter --version | grep -F "Flutter 3.47.1 "
 
-  test-flutter-matrix:
+  test-matrix:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve valid matrix
         id: valid
-        uses: ./flutter-matrix
+        uses: ./matrix
         with:
           targets: '["linux", "ios", "windows"]'
           build-mode: "profile"
@@ -107,7 +117,7 @@ jobs:
       - name: Resolve invalid matrix
         id: invalid
         continue-on-error: true
-        uses: ./flutter-matrix
+        uses: ./matrix
         with:
           targets: '["linux", "bogus"]'
 
@@ -120,3 +130,10 @@ jobs:
             echo "Expected invalid target to fail, got outcome '$OUTCOME'"
             exit 1
           fi
+
+  # Runs main's actions (ci.yml references them @main), so this covers the workflow's wiring, not this checkout's actions.
+  test-ci:
+    uses: ./.github/workflows/ci.yml
+    with:
+      targets: '["linux"]'
+      working-directory: "tests/fixtures"
diff --git a/build/action.yml b/build/action.yml
index d5fe7ba..738ae85 100644
--- a/build/action.yml
+++ b/build/action.yml
@@ -31,19 +31,28 @@ outputs:
     description: "Base name of packaged artifact"
     value: ${{ steps.package-meta.outputs.artifact-name }}
   artifact-path:
-    description: "Path or glob of packaged artifact(s)"
+    description: "Glob of the packaged artifact(s), in a directory under the runner temp folder"
     value: ${{ steps.package-meta.outputs.artifact-path }}
 
 runs:
   using: "composite"
   steps:
+    - name: Resolve App Metadata
+      id: meta
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        TARGET: ${{ inputs.target }}
+        BUILD_MODE: ${{ inputs.build-mode }}
+      run: bash "${{ github.action_path }}/scripts/resolve-metadata.sh"
+
     - name: Resolve Flutter version
       id: version
       shell: bash
       working-directory: ${{ inputs.working-directory }}
       env:
         FLUTTER_VERSION_INPUT: ${{ inputs.flutter-version }}
-      run: bash "${{ github.action_path }}/../setup-flutter/scripts/resolve-version.sh"
+      run: bash "${{ github.action_path }}/../setup/scripts/resolve-version.sh"
 
     - name: Set up Flutter
       uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
@@ -52,21 +61,12 @@ runs:
         channel: ${{ inputs.channel }}
         cache: ${{ inputs.cache == 'true' }}
 
-    - name: Resolve App Metadata
-      id: meta
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}
-      env:
-        TARGET: ${{ inputs.target }}
-        BUILD_MODE: ${{ inputs.build-mode }}
-      run: bash "${{ github.action_path }}/scripts/resolve-metadata.sh"
-
     - name: Install Linux dependencies
       if: inputs.target == 'linux'
       shell: bash
       run: |
         sudo apt-get update -qq
-        sudo apt-get install -y -qq libgtk-3-dev libblkid-dev liblzma-dev libglib2.0-dev
+        sudo apt-get install -y -qq clang cmake ninja-build pkg-config libgtk-3-dev libblkid-dev liblzma-dev libglib2.0-dev
 
     - name: Install Dart dependencies
       shell: bash
@@ -134,8 +134,9 @@ runs:
       working-directory: ${{ inputs.working-directory }}
       env:
         BUILD_MODE: ${{ inputs.build-mode }}
-        APP_NAME: ${{ env.APP_NAME }}
-        MODE_SUFFIX: ${{ env.MODE_SUFFIX }}
+        APP_NAME: ${{ steps.meta.outputs.app-name }}
+        MODE_SUFFIX: ${{ steps.meta.outputs.mode-suffix }}
+        DIST_DIR: ${{ steps.meta.outputs.dist-dir }}
       run: bash "${{ github.action_path }}/scripts/package-linux.sh"
 
     - name: Package macOS
@@ -144,8 +145,9 @@ runs:
       working-directory: ${{ inputs.working-directory }}
       env:
         BUILD_MODE: ${{ inputs.build-mode }}
-        APP_NAME: ${{ env.APP_NAME }}
-        MODE_SUFFIX: ${{ env.MODE_SUFFIX }}
+        APP_NAME: ${{ steps.meta.outputs.app-name }}
+        MODE_SUFFIX: ${{ steps.meta.outputs.mode-suffix }}
+        DIST_DIR: ${{ steps.meta.outputs.dist-dir }}
       run: bash "${{ github.action_path }}/scripts/package-macos.sh"
 
     - name: Package Windows
@@ -154,8 +156,9 @@ runs:
       working-directory: ${{ inputs.working-directory }}
       env:
         BUILD_MODE: ${{ inputs.build-mode }}
-        APP_NAME: ${{ env.APP_NAME }}
-        MODE_SUFFIX: ${{ env.MODE_SUFFIX }}
+        APP_NAME: ${{ steps.meta.outputs.app-name }}
+        MODE_SUFFIX: ${{ steps.meta.outputs.mode-suffix }}
+        DIST_DIR: ${{ steps.meta.outputs.dist-dir }}
       run: pwsh "${{ github.action_path }}/scripts/package-windows.ps1"
 
     - name: Package Android
@@ -165,8 +168,9 @@ runs:
       env:
         TARGET: ${{ inputs.target }}
         BUILD_MODE: ${{ inputs.build-mode }}
-        APP_NAME: ${{ env.APP_NAME }}
-        MODE_SUFFIX: ${{ env.MODE_SUFFIX }}
+        APP_NAME: ${{ steps.meta.outputs.app-name }}
+        MODE_SUFFIX: ${{ steps.meta.outputs.mode-suffix }}
+        DIST_DIR: ${{ steps.meta.outputs.dist-dir }}
       run: bash "${{ github.action_path }}/scripts/package-android.sh"
 
     - name: Package iOS
@@ -174,8 +178,9 @@ runs:
       shell: bash
       working-directory: ${{ inputs.working-directory }}
       env:
-        APP_NAME: ${{ env.APP_NAME }}
-        MODE_SUFFIX: ${{ env.MODE_SUFFIX }}
+        APP_NAME: ${{ steps.meta.outputs.app-name }}
+        MODE_SUFFIX: ${{ steps.meta.outputs.mode-suffix }}
+        DIST_DIR: ${{ steps.meta.outputs.dist-dir }}
       run: bash "${{ github.action_path }}/scripts/package-ios.sh"
 
     - name: Set artifact outputs
@@ -184,5 +189,7 @@ runs:
       working-directory: ${{ inputs.working-directory }}
       env:
         TARGET: ${{ inputs.target }}
-        WORKING_DIRECTORY: ${{ inputs.working-directory }}
+        APP_NAME: ${{ steps.meta.outputs.app-name }}
+        MODE_SUFFIX: ${{ steps.meta.outputs.mode-suffix }}
+        DIST_DIR: ${{ steps.meta.outputs.dist-dir }}
       run: bash "${{ github.action_path }}/scripts/set-artifact-outputs.sh"
diff --git a/build/scripts/package-android.sh b/build/scripts/package-android.sh
index e24612f..39e62cf 100755
--- a/build/scripts/package-android.sh
+++ b/build/scripts/package-android.sh
@@ -5,12 +5,13 @@ BUILD_MODE="${BUILD_MODE:-release}"
 APP_NAME="${APP_NAME:-app}"
 MODE_SUFFIX="${MODE_SUFFIX:-}"
 
-mkdir -p dist
+: "${DIST_DIR:?}"
+mkdir -p "$DIST_DIR"
 
 if [ "$TARGET" = "android-apk" ] && [ -d "build/app/outputs/flutter-apk" ]; then
   APK_FILE=$(find build/app/outputs/flutter-apk -maxdepth 1 -name "*${BUILD_MODE}*.apk" | head -n 1)
   if [ -n "$APK_FILE" ]; then
-    cp "$APK_FILE" "dist/${APP_NAME}-android${MODE_SUFFIX}.apk"
+    cp "$APK_FILE" "$DIST_DIR/${APP_NAME}-android${MODE_SUFFIX}.apk"
   fi
 fi
 
@@ -20,6 +21,6 @@ if [ "$TARGET" = "android-aab" ] && [ -d "build/app/outputs/bundle" ]; then
     AAB_FILE=$(find build/app/outputs/bundle -name "*.aab" | head -n 1)
   fi
   if [ -n "$AAB_FILE" ]; then
-    cp "$AAB_FILE" "dist/${APP_NAME}-android${MODE_SUFFIX}.aab"
+    cp "$AAB_FILE" "$DIST_DIR/${APP_NAME}-android${MODE_SUFFIX}.aab"
   fi
 fi
\ No newline at end of file
diff --git a/build/scripts/package-ios.sh b/build/scripts/package-ios.sh
index a592a53..7d22f9b 100755
--- a/build/scripts/package-ios.sh
+++ b/build/scripts/package-ios.sh
@@ -4,11 +4,12 @@ set -euo pipefail
 APP_NAME="${APP_NAME:-app}"
 MODE_SUFFIX="${MODE_SUFFIX:-}"
 
-mkdir -p dist
+: "${DIST_DIR:?}"
+mkdir -p "$DIST_DIR"
 
 if [ ! -d "build/ios/iphoneos/Runner.app" ]; then
   echo "::error::ios Runner.app bundle not found"
   exit 1
 fi
 
-ditto -c -k --sequesterRsrc "build/ios/iphoneos/Runner.app" "dist/${APP_NAME}-ios-unsigned${MODE_SUFFIX}.zip"
+ditto -c -k --sequesterRsrc "build/ios/iphoneos/Runner.app" "$DIST_DIR/${APP_NAME}-ios-unsigned${MODE_SUFFIX}.zip"
diff --git a/build/scripts/package-linux.sh b/build/scripts/package-linux.sh
index 436d2a1..7da10ea 100755
--- a/build/scripts/package-linux.sh
+++ b/build/scripts/package-linux.sh
@@ -5,5 +5,7 @@ BUILD_MODE="${BUILD_MODE:-release}"
 APP_NAME="${APP_NAME:-app}"
 MODE_SUFFIX="${MODE_SUFFIX:-}"
 
-mkdir -p dist
-tar -czf "dist/${APP_NAME}-linux${MODE_SUFFIX}.tar.gz" -C "build/linux/x64/${BUILD_MODE}/bundle" .
+: "${DIST_DIR:?}"
+mkdir -p "$DIST_DIR"
+# ponytail: x64 only; arm64 runners need build/linux/arm64 once targets.json offers them.
+tar -czf "$DIST_DIR/${APP_NAME}-linux${MODE_SUFFIX}.tar.gz" -C "build/linux/x64/${BUILD_MODE}/bundle" .
diff --git a/build/scripts/package-macos.sh b/build/scripts/package-macos.sh
index de26b02..14da994 100755
--- a/build/scripts/package-macos.sh
+++ b/build/scripts/package-macos.sh
@@ -5,7 +5,8 @@ APP_NAME="${APP_NAME:-app}"
 BUILD_MODE="${BUILD_MODE:-release}"
 MODE_SUFFIX="${MODE_SUFFIX:-}"
 
-mkdir -p dist
+: "${DIST_DIR:?}"
+mkdir -p "$DIST_DIR"
 
 APP_PATH=""
 if [ -d "build/macos/Build/Products" ]; then
@@ -17,4 +18,4 @@ if [ -z "$APP_PATH" ]; then
   exit 1
 fi
 
-ditto -c -k --sequesterRsrc "$APP_PATH" "dist/${APP_NAME}-macos${MODE_SUFFIX}.zip"
+ditto -c -k --sequesterRsrc "$APP_PATH" "$DIST_DIR/${APP_NAME}-macos${MODE_SUFFIX}.zip"
diff --git a/build/scripts/package-windows.ps1 b/build/scripts/package-windows.ps1
index e3f663c..0a10e7f 100644
--- a/build/scripts/package-windows.ps1
+++ b/build/scripts/package-windows.ps1
@@ -4,7 +4,14 @@ $AppName = if ($env:APP_NAME) { $env:APP_NAME } else { "app" }
 $BuildMode = if ($env:BUILD_MODE) { $env:BUILD_MODE } else { "release" }
 $ModeSuffix = if ($env:MODE_SUFFIX) { $env:MODE_SUFFIX } else { "" }
 
-New-Item -ItemType Directory -Force -Path dist | Out-Null
+$DistDir = $env:DIST_DIR
+if (-not $DistDir) {
+  Write-Error "DIST_DIR is not set"
+  exit 1
+}
+New-Item -ItemType Directory -Force -Path $DistDir | Out-Null
+
+# ponytail: x64 only; arm64 runners need build/windows/arm64 once targets.json offers them.
 
 $runnerDir = Get-ChildItem -Path "build/windows/x64/runner" -Directory | Where-Object { $_.Name -like "*$BuildMode*" } | Select-Object -First 1
 if (-not $runnerDir) {
@@ -12,4 +19,4 @@ if (-not $runnerDir) {
   exit 1
 }
 
-Compress-Archive -Path "$($runnerDir.FullName)/*" -DestinationPath "dist/${AppName}-windows${ModeSuffix}.zip" -Force
+Compress-Archive -Path "$($runnerDir.FullName)/*" -DestinationPath "$DistDir/${AppName}-windows${ModeSuffix}.zip" -Force
diff --git a/build/scripts/resolve-metadata.sh b/build/scripts/resolve-metadata.sh
index 64b04ec..6f590a4 100755
--- a/build/scripts/resolve-metadata.sh
+++ b/build/scripts/resolve-metadata.sh
@@ -21,16 +21,26 @@ else
   MODE_SUFFIX="-${BUILD_MODE}"
 fi
 
-echo "BUILD_MODE=$BUILD_MODE" >> "$GITHUB_ENV"
-echo "MODE_SUFFIX=$MODE_SUFFIX" >> "$GITHUB_ENV"
-
 if [ ! -f pubspec.yaml ]; then
   echo "::error::pubspec.yaml not found in $PWD"
   exit 1
 fi
 
-NAME=$(sed -n "s/^name:[[:space:]]*//p" pubspec.yaml | head -n 1 | tr -d '\r"'\'' ')
+NAME=$(sed -n "s/^name:[[:space:]]*//p" pubspec.yaml | head -n 1 | tr -d '\r' | sed 's/[[:space:]]*#.*$//' | tr -d '"'\'' ')
 NAME="${NAME:-app}"
+# The name ends up in file and artifact names; Dart's own rule keeps it path-safe.
+if [[ ! "$NAME" =~ ^[a-z_][a-z0-9_]*$ ]]; then
+  echo "::error::Invalid pubspec.yaml name '$NAME': must match ^[a-z_][a-z0-9_]*\$"
+  exit 1
+fi
+
+# The action owns this directory, so a consumer's own dist/ is never packaged and repeated builds in one job don't mix.
+DIST_DIR="${RUNNER_TEMP:?}/flutter-dist/${TARGET}"
+rm -rf "$DIST_DIR"
+mkdir -p "$DIST_DIR"
 
-echo "APP_NAME=$NAME" >> "$GITHUB_ENV"
-echo "app-name=$NAME" >> "$GITHUB_OUTPUT"
+{
+  echo "app-name=$NAME"
+  echo "mode-suffix=$MODE_SUFFIX"
+  echo "dist-dir=$DIST_DIR"
+} >> "$GITHUB_OUTPUT"
diff --git a/build/scripts/set-artifact-outputs.sh b/build/scripts/set-artifact-outputs.sh
index 0c69278..46d1948 100644
--- a/build/scripts/set-artifact-outputs.sh
+++ b/build/scripts/set-artifact-outputs.sh
@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-if [ ! -d "dist" ] || [ -z "$(ls -A dist 2>/dev/null)" ]; then
-  echo "::error::Packaging produced no artifacts in dist/"
+: "${DIST_DIR:?}"
+if [ ! -d "$DIST_DIR" ] || [ -z "$(ls -A "$DIST_DIR" 2>/dev/null)" ]; then
+  echo "::error::Packaging produced no artifacts in $DIST_DIR"
   exit 1
 fi
 echo "artifact-name=${APP_NAME}-${TARGET}${MODE_SUFFIX}" >> "$GITHUB_OUTPUT"
-echo "artifact-path=${WORKING_DIRECTORY}/dist/*" >> "$GITHUB_OUTPUT"
+echo "artifact-path=${DIST_DIR}/*" >> "$GITHUB_OUTPUT"
diff --git a/matrix/scripts/resolve-matrix.sh b/matrix/scripts/resolve-matrix.sh
index 47f8afe..ebb7c79 100644
--- a/matrix/scripts/resolve-matrix.sh
+++ b/matrix/scripts/resolve-matrix.sh
@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 # Resolves the Flutter build matrix and build mode for the current event.
-# Single source of truth for valid targets and runner mapping: build-flutter/targets.json
+# Single source of truth for valid targets and runner mapping: build/targets.json
 set -euo pipefail
 
-TARGETS_FILE="${TARGETS_FILE:-${GITHUB_ACTION_PATH}/../build-flutter/targets.json}"
+TARGETS_FILE="${TARGETS_FILE:-${GITHUB_ACTION_PATH}/../build/targets.json}"
 
 TARGETS_JSON="${TARGETS_INPUT:-}"
 BUILD_MODE="${BUILD_MODE_INPUT:-}"
@@ -28,6 +28,13 @@ if ! echo "$TARGETS_JSON" | jq -e 'type == "array" and length > 0 and all(type =
   exit 1
 fi
 
+# Duplicates would give two matrix jobs uploading the same artifact name, which upload-artifact rejects.
+DUPLICATES=$(echo "$TARGETS_JSON" | jq -c 'group_by(.) | map(select(length > 1) | .[0])')
+if [ "$DUPLICATES" != "[]" ]; then
+  echo "::error::Duplicate target(s): $DUPLICATES"
+  exit 1
+fi
+
 case "$BUILD_MODE" in
   debug|profile|release) ;;
   *)
diff --git a/tests/fixtures/test/app_test.dart b/tests/fixtures/test/app_test.dart
new file mode 100644
index 0000000..1f5c1a7
--- /dev/null
+++ b/tests/fixtures/test/app_test.dart
@@ -0,0 +1,7 @@
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('fixture has a test for ci.yml to run', () {
+    expect(1 + 1, 2);
+  });
+}
diff --git a/tests/lib.sh b/tests/lib.sh
deleted file mode 100644
index b70feb7..0000000
--- a/tests/lib.sh
+++ /dev/null
@@ -1,118 +0,0 @@
-# shellcheck shell=bash
-# Shared harness for tests/*.test.sh. Sourced, never executed.
-# Must stay bash 3.2 compatible: macOS runners ship it.
-#
-# Each case: new_case; set up files in "$WORK"; run <script> [VAR=val ...]; assert.
-set -euo pipefail
-
-# shellcheck disable=SC2034 # used by the test files that source this.
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-TEST_TMP=$(mktemp -d)
-trap 'rm -rf "$TEST_TMP"' EXIT
-STUB_DIR="$TEST_TMP/stubs"
-mkdir -p "$STUB_DIR"
-ASSERTIONS=0
-FAILURES=0
-STATUS=0
-CASE_DIR=""
-WORK=""
-
-# Exits 0 when the current OS is not listed, so a test only runs where its script runs in production.
-only_on() {
-  local os
-  case "$(uname -s)" in
-    Linux) os=linux ;;
-    Darwin) os=macos ;;
-    MINGW* | MSYS* | CYGWIN*) os=windows ;;
-    *) os=unknown ;;
-  esac
-  case " $* " in
-    *" $os "*) ;;
-    *)
-      echo "skip $(basename "$0"): not run on $os"
-      exit 0
-      ;;
-  esac
-}
-
-new_case() {
-  CASE_DIR=$(mktemp -d "$TEST_TMP/case.XXXXXX")
-  WORK="$CASE_DIR/work"
-  mkdir -p "$WORK"
-}
-
-# Runs a script inside $WORK with an emptied environment, so no variable leaks between cases or from CI.
-# Only OS plumbing is passed through; everything else must be given as VAR=val.
-run() {
-  local script="$1" v
-  shift
-  local keep=("PATH=$STUB_DIR:$PATH")
-  for v in HOME TMPDIR TEMP TMP LANG SYSTEMROOT WINDIR USERPROFILE APPDATA LOCALAPPDATA PROGRAMDATA PROGRAMFILES COMSPEC PATHEXT; do
-    if [ -n "${!v:-}" ]; then keep+=("$v=${!v}"); fi
-  done
-  : > "$CASE_DIR/output"
-  : > "$CASE_DIR/env"
-  local cmd=(bash "$script")
-  case "$script" in *.ps1) cmd=(pwsh -NoProfile -NonInteractive -File "$script") ;; esac
-  set +e
-  (cd "$WORK" && env -i "${keep[@]}" GITHUB_OUTPUT="$CASE_DIR/output" GITHUB_ENV="$CASE_DIR/env" \
-    STUB_LOG="$CASE_DIR/stubs.log" "$@" "${cmd[@]}") > "$CASE_DIR/stdout" 2>&1
-  STATUS=$?
-  set -e
-}
-
-# Puts a fake <cmd> on PATH that logs "<cmd> <args>" to $STUB_LOG, then runs the optional body.
-stub() {
-  # shellcheck disable=SC2016 # $* and $STUB_LOG must expand inside the stub, not here.
-  printf '#!/usr/bin/env bash\necho "%s $*" >> "$STUB_LOG"\n%s\n' "$1" "${2:-}" > "$STUB_DIR/$1"
-  chmod +x "$STUB_DIR/$1"
-}
-
-output() { sed -n "s/^$1=//p" "$CASE_DIR/output" | tail -n 1; }
-env_var() { sed -n "s/^$1=//p" "$CASE_DIR/env" | tail -n 1; }
-stub_log() { cat "$CASE_DIR/stubs.log" 2> /dev/null || true; }
-
-pass() {
-  ASSERTIONS=$((ASSERTIONS + 1))
-  echo "ok   $1"
-}
-
-fail() {
-  ASSERTIONS=$((ASSERTIONS + 1))
-  FAILURES=$((FAILURES + 1))
-  echo "FAIL $1: $2"
-  if [ -s "$CASE_DIR/stdout" ]; then sed 's/^/     | /' "$CASE_DIR/stdout"; fi
-}
-
-expect() {
-  if [ "$2" = "$3" ]; then pass "$1"; else fail "$1" "expected '$2', got '$3'"; fi
-}
-
-expect_ok() {
-  if [ "$STATUS" -eq 0 ]; then pass "$1"; else fail "$1" "exited $STATUS"; fi
-}
-
-# expect_fail <name> [substring that must appear in an ::error:: line]
-expect_fail() {
-  if [ "$STATUS" -eq 0 ]; then
-    fail "$1" "expected failure, exited 0"
-  elif [ -n "${2:-}" ] && ! grep '^::error::' "$CASE_DIR/stdout" | grep -qF -- "$2"; then
-    fail "$1" "no ::error:: containing '$2'"
-  else
-    pass "$1"
-  fi
-}
-
-expect_file() {
-  if [ -f "$WORK/$2" ]; then pass "$1"; else fail "$1" "missing $2 (have: $(cd "$WORK" && find . -type f | tr '\n' ' '))"; fi
-}
-
-# A test file that never asserts must not pass silently.
-finish() {
-  if [ "$ASSERTIONS" -eq 0 ]; then
-    echo "FAIL $(basename "$0"): no assertions ran"
-    exit 1
-  fi
-  echo "$((ASSERTIONS - FAILURES))/$ASSERTIONS passed in $(basename "$0")"
-  if [ "$FAILURES" -ne 0 ]; then exit 1; fi
-}
diff --git a/tests/package-android.test.sh b/tests/package-android.test.sh
index 5a03a22..566787b 100644
--- a/tests/package-android.test.sh
+++ b/tests/package-android.test.sh
@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
-# shellcheck source=tests/lib.sh
-source "$(dirname "$0")/lib.sh"
+# shellcheck source=.tooling/tests/lib.sh
+source "$(dirname "$0")/../.tooling/tests/lib.sh"
 only_on linux macos
 
-SCRIPT="$REPO_ROOT/build-flutter/scripts/package-android.sh"
+SCRIPT="$REPO_ROOT/build/scripts/package-android.sh"
 APK_DIR=build/app/outputs/flutter-apk
 AAB_DIR=build/app/outputs/bundle
 
@@ -16,40 +16,40 @@ put() {
 new_case
 put "$APK_DIR/app-release.apk"
 put "$APK_DIR/app-debug.apk"
-run "$SCRIPT" TARGET=android-apk BUILD_MODE=debug APP_NAME=my_app MODE_SUFFIX=-debug
+run "$SCRIPT" DIST_DIR=dist TARGET=android-apk BUILD_MODE=debug APP_NAME=my_app MODE_SUFFIX=-debug
 expect_ok "apk exits 0"
 expect_file "apk named with suffix" "dist/my_app-android-debug.apk"
 expect "apk matching build mode is picked" "$APK_DIR/app-debug.apk" "$(cat "$WORK/dist/my_app-android-debug.apk")"
 
 new_case
 put "$APK_DIR/app-release.apk"
-run "$SCRIPT" TARGET=android-apk BUILD_MODE=release APP_NAME=my_app MODE_SUFFIX=
+run "$SCRIPT" DIST_DIR=dist TARGET=android-apk BUILD_MODE=release APP_NAME=my_app MODE_SUFFIX=
 expect_file "release apk has no suffix" "dist/my_app-android.apk"
 
 new_case
 put "$APK_DIR/app-release.apk"
-run "$SCRIPT" TARGET=android-apk BUILD_MODE=profile APP_NAME=my_app MODE_SUFFIX=-profile
+run "$SCRIPT" DIST_DIR=dist TARGET=android-apk BUILD_MODE=profile APP_NAME=my_app MODE_SUFFIX=-profile
 expect "apk of another mode is never used" "" "$(ls "$WORK/dist")"
 
 new_case
 put "$AAB_DIR/release/app-release.aab"
 put "$AAB_DIR/profile/app-profile.aab"
-run "$SCRIPT" TARGET=android-aab BUILD_MODE=profile APP_NAME=my_app MODE_SUFFIX=-profile
+run "$SCRIPT" DIST_DIR=dist TARGET=android-aab BUILD_MODE=profile APP_NAME=my_app MODE_SUFFIX=-profile
 expect "aab matching build mode is picked" "$AAB_DIR/profile/app-profile.aab" "$(cat "$WORK/dist/my_app-android-profile.aab")"
 
 new_case
 put "$AAB_DIR/release/app-release.aab"
-run "$SCRIPT" TARGET=android-aab BUILD_MODE=debug APP_NAME=my_app MODE_SUFFIX=-debug
+run "$SCRIPT" DIST_DIR=dist TARGET=android-aab BUILD_MODE=debug APP_NAME=my_app MODE_SUFFIX=-debug
 expect "aab falls back to any bundle" "$AAB_DIR/release/app-release.aab" "$(cat "$WORK/dist/my_app-android-debug.aab")"
 
 new_case
 put "$APK_DIR/app-release.apk"
-run "$SCRIPT" TARGET=android-aab BUILD_MODE=release APP_NAME=my_app MODE_SUFFIX=
+run "$SCRIPT" DIST_DIR=dist TARGET=android-aab BUILD_MODE=release APP_NAME=my_app MODE_SUFFIX=
 expect "aab target ignores apk output" "" "$(ls "$WORK/dist")"
 
 # No build output is not an error here: set-artifact-outputs.sh fails on the empty dist/ instead.
 new_case
-run "$SCRIPT" TARGET=android-apk BUILD_MODE=release APP_NAME=my_app MODE_SUFFIX=
+run "$SCRIPT" DIST_DIR=dist TARGET=android-apk BUILD_MODE=release APP_NAME=my_app MODE_SUFFIX=
 expect_ok "missing build output exits 0"
 expect "missing build output leaves dist empty" "" "$(ls "$WORK/dist")"
 
diff --git a/tests/package-apple.test.sh b/tests/package-apple.test.sh
index 240af9f..64d9dec 100644
--- a/tests/package-apple.test.sh
+++ b/tests/package-apple.test.sh
@@ -1,19 +1,19 @@
 #!/usr/bin/env bash
-# shellcheck source=tests/lib.sh
-source "$(dirname "$0")/lib.sh"
+# shellcheck source=.tooling/tests/lib.sh
+source "$(dirname "$0")/../.tooling/tests/lib.sh"
 only_on linux macos
 
 # ditto only exists on macOS; the stub records what would be zipped and creates the zip.
 # shellcheck disable=SC2016 # expands inside the stub.
 stub ditto 'touch "${!#}"'
 
-MACOS="$REPO_ROOT/build-flutter/scripts/package-macos.sh"
-IOS="$REPO_ROOT/build-flutter/scripts/package-ios.sh"
+MACOS="$REPO_ROOT/build/scripts/package-macos.sh"
+IOS="$REPO_ROOT/build/scripts/package-ios.sh"
 PRODUCTS=build/macos/Build/Products
 
 new_case
 mkdir -p "$WORK/$PRODUCTS/Release/my_app.app" "$WORK/$PRODUCTS/Debug/my_app.app"
-run "$MACOS" BUILD_MODE=debug APP_NAME=my_app MODE_SUFFIX=-debug
+run "$MACOS" DIST_DIR=dist BUILD_MODE=debug APP_NAME=my_app MODE_SUFFIX=-debug
 expect_ok "macos exits 0"
 expect_file "macos zip name" "dist/my_app-macos-debug.zip"
 expect "macos zips the app of the build mode (case-insensitive)" \
@@ -21,28 +21,28 @@ expect "macos zips the app of the build mode (case-insensitive)" \
 
 new_case
 mkdir -p "$WORK/$PRODUCTS/Release/my_app.app"
-run "$MACOS" APP_NAME=my_app
+run "$MACOS" DIST_DIR=dist APP_NAME=my_app
 expect_file "macos defaults to release without suffix" "dist/my_app-macos.zip"
 
 new_case
 mkdir -p "$WORK/$PRODUCTS/Release/my_app.app"
-run "$MACOS" BUILD_MODE=profile APP_NAME=my_app MODE_SUFFIX=-profile
+run "$MACOS" DIST_DIR=dist BUILD_MODE=profile APP_NAME=my_app MODE_SUFFIX=-profile
 expect_fail "macos app for build mode missing" "macos .app bundle not found"
 expect "macos does not zip on failure" "" "$(stub_log)"
 
 new_case
-run "$MACOS" BUILD_MODE=release APP_NAME=my_app MODE_SUFFIX=
+run "$MACOS" DIST_DIR=dist BUILD_MODE=release APP_NAME=my_app MODE_SUFFIX=
 expect_fail "macos without build output" "macos .app bundle not found"
 
 new_case
 mkdir -p "$WORK/build/ios/iphoneos/Runner.app"
-run "$IOS" APP_NAME=my_app MODE_SUFFIX=-debug
+run "$IOS" DIST_DIR=dist APP_NAME=my_app MODE_SUFFIX=-debug
 expect_ok "ios exits 0"
 expect "ios zips Runner.app as unsigned" \
   "ditto -c -k --sequesterRsrc build/ios/iphoneos/Runner.app dist/my_app-ios-unsigned-debug.zip" "$(stub_log)"
 
 new_case
-run "$IOS" APP_NAME=my_app MODE_SUFFIX=
+run "$IOS" DIST_DIR=dist APP_NAME=my_app MODE_SUFFIX=
 expect_fail "ios without Runner.app" "ios Runner.app bundle not found"
 
 finish
diff --git a/tests/package-linux.test.sh b/tests/package-linux.test.sh
index e2215e7..c1ed42a 100644
--- a/tests/package-linux.test.sh
+++ b/tests/package-linux.test.sh
@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
-# shellcheck source=tests/lib.sh
-source "$(dirname "$0")/lib.sh"
+# shellcheck source=.tooling/tests/lib.sh
+source "$(dirname "$0")/../.tooling/tests/lib.sh"
 only_on linux macos
 
-SCRIPT="$REPO_ROOT/build-flutter/scripts/package-linux.sh"
+SCRIPT="$REPO_ROOT/build/scripts/package-linux.sh"
 
 for mode in release debug profile; do
   new_case
@@ -12,7 +12,7 @@ for mode in release debug profile; do
   touch "$WORK/build/linux/x64/$mode/bundle/lib/libapp.so"
   suffix="-$mode"
   if [ "$mode" = release ]; then suffix=""; fi
-  run "$SCRIPT" BUILD_MODE="$mode" APP_NAME=my_app MODE_SUFFIX="$suffix"
+  run "$SCRIPT" DIST_DIR=dist BUILD_MODE="$mode" APP_NAME=my_app MODE_SUFFIX="$suffix"
   expect_file "$mode archive name" "dist/my_app-linux$suffix.tar.gz"
   expect "$mode archive has bundle contents at its root" "./lib/libapp.so ./my_app" \
     "$(tar -tzf "$WORK/dist/my_app-linux$suffix.tar.gz" | grep -v '/$' | sort | tr '\n' ' ' | sed 's/ $//')"
@@ -20,7 +20,7 @@ done
 
 new_case
 mkdir -p "$WORK/build/linux/x64/release/bundle"
-run "$SCRIPT" BUILD_MODE=debug APP_NAME=my_app MODE_SUFFIX=-debug
+run "$SCRIPT" DIST_DIR=dist BUILD_MODE=debug APP_NAME=my_app MODE_SUFFIX=-debug
 expect_fail "missing bundle for build mode fails"
 
 finish
diff --git a/tests/package-windows.test.sh b/tests/package-windows.test.sh
index 0b8c5d3..bcdfeb8 100644
--- a/tests/package-windows.test.sh
+++ b/tests/package-windows.test.sh
@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
-# shellcheck source=tests/lib.sh
-source "$(dirname "$0")/lib.sh"
+# shellcheck source=.tooling/tests/lib.sh
+source "$(dirname "$0")/../.tooling/tests/lib.sh"
 only_on linux macos windows
 if ! command -v pwsh > /dev/null; then
   echo "skip $(basename "$0"): pwsh not installed (it is on every GitHub runner)"
   exit 0
 fi
 
-SCRIPT="$REPO_ROOT/build-flutter/scripts/package-windows.ps1"
+SCRIPT="$REPO_ROOT/build/scripts/package-windows.ps1"
 RUNNER=build/windows/x64/runner
 
 new_case
@@ -15,7 +15,7 @@ mkdir -p "$WORK/$RUNNER/Release" "$WORK/$RUNNER/Debug/data"
 echo release > "$WORK/$RUNNER/Release/my_app.exe"
 echo debug > "$WORK/$RUNNER/Debug/my_app.exe"
 touch "$WORK/$RUNNER/Debug/data/app.so"
-run "$SCRIPT" BUILD_MODE=debug APP_NAME=my_app MODE_SUFFIX=-debug
+run "$SCRIPT" DIST_DIR=dist BUILD_MODE=debug APP_NAME=my_app MODE_SUFFIX=-debug
 expect_ok "windows exits 0"
 expect_file "windows zip name" "dist/my_app-windows-debug.zip"
 # shellcheck disable=SC2016 # $_ is PowerShell, not bash.
@@ -25,12 +25,12 @@ expect "windows zips the runner dir of the build mode (case-insensitive)" "data/
 new_case
 mkdir -p "$WORK/$RUNNER/Release"
 echo release > "$WORK/$RUNNER/Release/my_app.exe"
-run "$SCRIPT" APP_NAME=my_app
+run "$SCRIPT" DIST_DIR=dist APP_NAME=my_app
 expect_file "windows defaults to release without suffix" "dist/my_app-windows.zip"
 
 new_case
 mkdir -p "$WORK/$RUNNER/Release"
-run "$SCRIPT" BUILD_MODE=profile APP_NAME=my_app MODE_SUFFIX=-profile
+run "$SCRIPT" DIST_DIR=dist BUILD_MODE=profile APP_NAME=my_app MODE_SUFFIX=-profile
 expect_fail "windows runner dir for build mode missing"
 
 finish
diff --git a/tests/resolve-matrix.test.sh b/tests/resolve-matrix.test.sh
index 3b7bc04..7266338 100644
--- a/tests/resolve-matrix.test.sh
+++ b/tests/resolve-matrix.test.sh
@@ -1,12 +1,12 @@
 #!/usr/bin/env bash
-# shellcheck source=tests/lib.sh
-source "$(dirname "$0")/lib.sh"
+# shellcheck source=.tooling/tests/lib.sh
+source "$(dirname "$0")/../.tooling/tests/lib.sh"
 only_on linux macos
 
-SCRIPT="$REPO_ROOT/flutter-matrix/scripts/resolve-matrix.sh"
-TARGETS_JSON_FILE="$REPO_ROOT/build-flutter/targets.json"
+SCRIPT="$REPO_ROOT/matrix/scripts/resolve-matrix.sh"
+TARGETS_JSON_FILE="$REPO_ROOT/build/targets.json"
 # The script finds targets.json relative to its own action, exactly as on a runner.
-ACTION_PATH="GITHUB_ACTION_PATH=$REPO_ROOT/flutter-matrix"
+ACTION_PATH="GITHUB_ACTION_PATH=$REPO_ROOT/matrix"
 
 resolve() {
   new_case
@@ -79,4 +79,7 @@ expect "every target maps to its targets.json runner, in input order" \
 resolve EVENT_NAME=push TARGETS_INPUT='["ios","linux"]'
 expect "input order is kept" '[{"target":"ios","os":"macos-latest"},{"target":"linux","os":"ubuntu-latest"}]' "$(output matrix)"
 
+resolve TARGETS_INPUT='["linux", "ios", "linux"]'
+expect_fail "rejects duplicate targets" 'Duplicate target(s): ["linux"]'
+
 finish
diff --git a/tests/resolve-metadata.test.sh b/tests/resolve-metadata.test.sh
index e7e7bc3..16ff3b4 100644
--- a/tests/resolve-metadata.test.sh
+++ b/tests/resolve-metadata.test.sh
@@ -1,22 +1,22 @@
 #!/usr/bin/env bash
-# shellcheck source=tests/lib.sh
-source "$(dirname "$0")/lib.sh"
+# shellcheck source=.tooling/tests/lib.sh
+source "$(dirname "$0")/../.tooling/tests/lib.sh"
 only_on linux macos windows
 
-SCRIPT="$REPO_ROOT/build-flutter/scripts/resolve-metadata.sh"
-ACTION_PATH="GITHUB_ACTION_PATH=$REPO_ROOT/build-flutter"
+SCRIPT="$REPO_ROOT/build/scripts/resolve-metadata.sh"
+ACTION_PATH="GITHUB_ACTION_PATH=$REPO_ROOT/build"
 
 # resolve <pubspec content, empty for none> [VAR=val ...]
 resolve() {
   new_case
   if [ -n "$1" ]; then printf '%b' "$1" > "$WORK/pubspec.yaml"; fi
   shift
-  run "$SCRIPT" "$ACTION_PATH" "$@"
+  run "$SCRIPT" "$ACTION_PATH" RUNNER_TEMP="$CASE_DIR/tmp" "$@"
 }
 
 PUBSPEC='name: my_app\nversion: 1.0.0\n'
 
-for target in $(jq -r 'keys_unsorted[]' "$REPO_ROOT/build-flutter/targets.json" | tr -d '\r'); do
+for target in $(jq -r 'keys_unsorted[]' "$REPO_ROOT/build/targets.json" | tr -d '\r'); do
   resolve "$PUBSPEC" TARGET="$target" BUILD_MODE=release
   expect_ok "accepts target $target"
 done
@@ -29,14 +29,15 @@ resolve "$PUBSPEC" TARGET=linux BUILD_MODE=fast
 expect_fail "rejects unknown build mode" "Unsupported build mode: fast"
 
 resolve "$PUBSPEC" TARGET=linux BUILD_MODE=release
-expect "release has no suffix" "" "$(env_var MODE_SUFFIX)"
-expect "BUILD_MODE exported" "release" "$(env_var BUILD_MODE)"
-expect "APP_NAME exported" "my_app" "$(env_var APP_NAME)"
+expect "release has no suffix" "" "$(output mode-suffix)"
 expect "app-name output" "my_app" "$(output app-name)"
+expect "dist-dir is per target under RUNNER_TEMP" "$CASE_DIR/tmp/flutter-dist/linux" "$(output dist-dir)"
+expect "dist-dir is created" "yes" "$(test -d "$CASE_DIR/tmp/flutter-dist/linux" && echo yes)"
+expect "nothing is exported to GITHUB_ENV" "" "$(cat "$CASE_DIR/env")"
 
 for mode in debug profile; do
   resolve "$PUBSPEC" TARGET=linux BUILD_MODE="$mode"
-  expect "$mode suffix" "-$mode" "$(env_var MODE_SUFFIX)"
+  expect "$mode suffix" "-$mode" "$(output mode-suffix)"
 done
 
 resolve 'name: "quoted_app"\n' TARGET=linux BUILD_MODE=release
@@ -51,6 +52,22 @@ expect "crlf name" "crlf_app" "$(output app-name)"
 resolve 'description: x\nflutter:\n  name: nested\nname: top_app\n' TARGET=linux BUILD_MODE=release
 expect "only top-level name counts" "top_app" "$(output app-name)"
 
+resolve 'name: commented_app # the app\n' TARGET=linux BUILD_MODE=release
+expect "trailing comment is stripped" "commented_app" "$(output app-name)"
+
+resolve 'name: "../evil"\n' TARGET=linux BUILD_MODE=release
+expect_fail "rejects a name Dart would reject" "Invalid pubspec.yaml name '../evil'"
+
+resolve 'name: My-App\n' TARGET=linux BUILD_MODE=release
+expect_fail "rejects uppercase and dashes" "Invalid pubspec.yaml name"
+
+new_case
+printf 'name: my_app\n' > "$WORK/pubspec.yaml"
+mkdir -p "$CASE_DIR/tmp/flutter-dist/linux"
+touch "$CASE_DIR/tmp/flutter-dist/linux/stale.tar.gz"
+run "$SCRIPT" "$ACTION_PATH" RUNNER_TEMP="$CASE_DIR/tmp" TARGET=linux BUILD_MODE=release
+expect "stale artifacts from an earlier build are removed" "" "$(ls "$CASE_DIR/tmp/flutter-dist/linux")"
+
 resolve 'version: 1.0.0\n' TARGET=linux BUILD_MODE=release
 expect "missing name falls back to app" "app" "$(output app-name)"
 
diff --git a/tests/resolve-version.test.sh b/tests/resolve-version.test.sh
index 0602c83..bccb960 100644
--- a/tests/resolve-version.test.sh
+++ b/tests/resolve-version.test.sh
@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
-# shellcheck source=tests/lib.sh
-source "$(dirname "$0")/lib.sh"
+# shellcheck source=.tooling/tests/lib.sh
+source "$(dirname "$0")/../.tooling/tests/lib.sh"
 only_on linux macos windows
 
-SCRIPT="$REPO_ROOT/setup-flutter/scripts/resolve-version.sh"
+SCRIPT="$REPO_ROOT/setup/scripts/resolve-version.sh"
 ENV_HEAD='name: app\nenvironment:\n  sdk: ^3.13.1\n'
 DEPS='dependencies:\n  flutter:\n    sdk: flutter\nflutter:\n  uses-material-design: true\n'
 
diff --git a/tests/set-artifact-outputs.test.sh b/tests/set-artifact-outputs.test.sh
index 6831449..820484f 100644
--- a/tests/set-artifact-outputs.test.sh
+++ b/tests/set-artifact-outputs.test.sh
@@ -1,26 +1,26 @@
 #!/usr/bin/env bash
-# shellcheck source=tests/lib.sh
-source "$(dirname "$0")/lib.sh"
+# shellcheck source=.tooling/tests/lib.sh
+source "$(dirname "$0")/../.tooling/tests/lib.sh"
 only_on linux macos windows
 
-SCRIPT="$REPO_ROOT/build-flutter/scripts/set-artifact-outputs.sh"
-VARS=(APP_NAME=my_app TARGET=android-apk MODE_SUFFIX=-debug WORKING_DIRECTORY=apps/mobile)
+SCRIPT="$REPO_ROOT/build/scripts/set-artifact-outputs.sh"
+VARS=(APP_NAME=my_app TARGET=android-apk MODE_SUFFIX=-debug DIST_DIR=out)
 
 new_case
-mkdir -p "$WORK/dist"
-touch "$WORK/dist/my_app-android-debug.apk"
+mkdir -p "$WORK/out"
+touch "$WORK/out/my_app-android-debug.apk"
 run "$SCRIPT" "${VARS[@]}"
 expect "artifact-name" "my_app-android-apk-debug" "$(output artifact-name)"
-expect "artifact-path" "apps/mobile/dist/*" "$(output artifact-path)"
+expect "artifact-path is the dist dir glob" "out/*" "$(output artifact-path)"
 
 new_case
-mkdir -p "$WORK/dist"
-touch "$WORK/dist/my_app-linux.tar.gz"
-run "$SCRIPT" APP_NAME=my_app TARGET=linux MODE_SUFFIX= WORKING_DIRECTORY=.
+mkdir -p "$WORK/out"
+touch "$WORK/out/my_app-linux.tar.gz"
+run "$SCRIPT" APP_NAME=my_app TARGET=linux MODE_SUFFIX= DIST_DIR=out
 expect "release artifact-name has no suffix" "my_app-linux" "$(output artifact-name)"
 
 new_case
-mkdir -p "$WORK/dist"
+mkdir -p "$WORK/out"
 run "$SCRIPT" "${VARS[@]}"
 expect_fail "empty dist" "Packaging produced no artifacts"
 expect "no outputs on failure" "" "$(output artifact-name)"
@@ -29,4 +29,8 @@ new_case
 run "$SCRIPT" "${VARS[@]}"
 expect_fail "missing dist" "Packaging produced no artifacts"
 
+new_case
+run "$SCRIPT" APP_NAME=my_app TARGET=linux MODE_SUFFIX=
+expect_fail "DIST_DIR is required"
+
 finish

From 07a35c5a64ca04e76cced3eebaa5e9db56bea929 Mon Sep 17 00:00:00 2001
From: Sem Van Broekhoven <144097969+dotsem@users.noreply.github.com>
Date: Thu, 12 Nov 2026 13:40:37 +0100
Subject: [PATCH 7/7] docs(readme): remove information from other actions &
 workflows from before the split

---
 README.md | 270 +++++++++++-------------------------------------------
 1 file changed, 52 insertions(+), 218 deletions(-)

diff --git a/README.md b/README.md
index 1afff76..9650355 100644
--- a/README.md
+++ b/README.md
@@ -1,35 +1,37 @@
-# Shared actions
+# dotactions/flutter
 
-## Versioning
+Composite actions and reusable workflows to set up, test, build and package Flutter apps for Linux, macOS, Windows, Android and iOS.
 
-Pin a **full commit SHA** of a release tag (most secure, Semgrep standard), with the version in a comment:
+## Versioning
 
-```yaml
-uses: dotsem/actions/.github/workflows/flutter-ci.yml@<40-char-sha> # v0.5.0
-```
+This repo is on **0.x** until release artifacts can be signed (see [Limitations](#limitations)). During `0.x`, a **minor** release may contain breaking changes.
 
-Or pin a **minor** tag (convenient, receives patch fixes):
+Pin the **full commit SHA** of a release tag, with the version in a comment, or a floating minor tag:
 
 ```yaml
-uses: dotsem/actions/.github/workflows/flutter-ci.yml@v0.5
+uses: dotactions/flutter/.github/workflows/ci.yml@<40-char-sha> # v0.1.0
+uses: dotactions/flutter/.github/workflows/ci.yml@v0.1
 ```
 
-Resolve a SHA with `git ls-remote https://github.com/dotsem/actions 'refs/tags/v0.5.0^{}'`. Only SHAs of **release tags** pin the whole tree; a SHA from `main` still contains `@main` self-references.
+Resolve a SHA with `git ls-remote https://github.com/dotactions/flutter 'refs/tags/v0.1.0^{}'`. Only SHAs of **release tags** pin the whole tree; a SHA from `main` still contains `@main` self-references.
+
+| Ref | Moves on | Use |
+| :-- | :-- | :-- |
+| `@<sha>` | never | **Recommended**: immutable, full reproducibility |
+| `@v0.1` | patch releases of `0.1` | **Recommended**: bug fixes, no breaking changes |
+| `@v0.1.0` | never (tag can be moved) | Readable, but tags are mutable |
+| `@v0` | every `0.x` release | Not recommended: during `0.x`, minor releases may break you |
 
-| Ref       | Moves on                 | Use                                                                       |
-| :-------- | :----------------------- | :------------------------------------------------------------------------ |
-| `@<sha>`  | never                    | **Recommended** (recommended by SemGrep): immutable, full reproducibility |
-| `@v0.5`   | patch releases of `0.5`  | **Recommended**: bug fixes, no breaking changes                           |
-| `@v0.5.0` | never (tag can be moved) | Readable, but tags are mutable                                            |
-| `@v0`     | every `0.x` release      | Not recommended: during `0.x`, minor releases may break you               |
+Release notes: [GitHub Releases](https://github.com/dotactions/flutter/releases).
 
-Every release tag pins the **whole tree**. Reusable workflows and actions that call other actions in this repo get those references rewritten to the same release tag, so `flutter-ci.yml@v0.5.0` always runs `build-flutter@v0.5.0`. On `main`, self-references are `@main`.
+## Limitations
 
-Release notes: [GitHub Releases](https://github.com/dotsem/actions/releases).
+- **Artifacts are unsigned.** iOS builds use `--no-codesign` and can't be installed. macOS apps are neither signed nor notarized, so Gatekeeper blocks them. Android release builds use your project's own signing config, which in the Flutter template is the debug key, so the Play Store rejects them. Windows executables aren't signed. v1.0.0 follows once signing is supported.
+- **Desktop builds are x64 only** (`ubuntu-latest`, `windows-latest`); arm64 runners aren't supported yet.
 
 ## Permissions
 
-Examples assume a **public** repository. In a **private** repository, `actions/checkout` needs `contents: read`, so every job using these actions (or `flutter-ci.yml`) must grant it:
+Examples assume a **public** repository. In a **private** repository, `actions/checkout` needs `contents: read`, so every job using these actions (or `ci.yml`) must grant it:
 
 ```yaml
 permissions:
@@ -40,99 +42,7 @@ Reusable workflows can only narrow the caller's token permissions, never widen t
 
 ## Actions
 
-### Setup Node & pnpm (`setup-node`)
-
-Configures PNPM, sets up the Node.js runtime, restores cached dependencies, and runs `pnpm install --frozen-lockfile`.
-
-> **Prerequisite**: Run `actions/checkout` before calling this action.
-
-#### Inputs
-
-| Name                    | Description                                                                                 | Required | Default |
-| :---------------------- | :------------------------------------------------------------------------------------------ | :------- | :------ |
-| `node-version`          | Target Node.js version                                                                      | No       | `"24"`  |
-| `pnpm-version`          | Specific PNPM version (empty string reads from `package.json`)                              | No       | `""`    |
-| `working-directory`     | Directory containing the target `package.json`                                              | No       | `"."`   |
-| `cache-dependency-path` | Explicit lockfile path for cache hashing (defaults to `<working-directory>/pnpm-lock.yaml`) | No       | `""`    |
-
-#### Usage
-
-```yaml
-- uses: dotsem/actions/setup-node@v0.5
-  with:
-      node-version: "24"
-      working-directory: "frontend"
-```
-
-### Build Node (`build-node`)
-
-Runs a production build command using PNPM in the specified directory.
-
-#### Inputs
-
-| Name                | Description                                               | Required | Default   |
-| :------------------ | :-------------------------------------------------------- | :------- | :-------- |
-| `working-directory` | Directory to execute the build command in                 | No       | `"."`     |
-| `script`            | Lifecycle script defined in package.json                  | No       | `"build"` |
-| `args`              | Additional CLI flags passed to the script (e.g. --filter) | No       | `""`      |
-
-#### Usage
-
-```yaml
-- uses: dotsem/actions/build-node@v0.5
-  with:
-      working-directory: "frontend"
-      script: "build"
-      args: "--filter=web"
-```
-
-### Security Report (`security-report`)
-
-Parses SARIF output, appends a detailed markdown summary with badge to the GitHub Actions Job Summary, upserts a sticky PR comment, and manages automated issue tracking.
-
-#### Permissions Required
-
-```yaml
-permissions:
-    contents: read
-    pull-requests: write # for sticky PR comments
-    issues: write # for automated issue management
-```
-
-#### Inputs
-
-| Name               | Description                                           | Required | Default                                              |
-| :----------------- | :---------------------------------------------------- | :------- | :--------------------------------------------------- |
-| `sarif-file`       | Path to SARIF output file                             | Yes      | -                                                    |
-| `title`            | Header title in report                                | No       | `"Security Scan Report"`                             |
-| `comment-tag`      | Identifier tag for sticky PR comments & issue markers | No       | `"security-report"`                                  |
-| `badge-label`      | Label text for shields.io badge                       | No       | `"Security"`                                         |
-| `github-token`     | Token with PR and issues write permissions            | No       | `${{ github.token }}`                                |
-| `fail-on-findings` | Fail step if findings are detected                    | No       | `"false"`                                            |
-| `manage-issue`     | Create/update/close tracked GitHub issue              | No       | `"false"`                                            |
-| `issue-title`      | Title of automated GitHub issue                       | No       | `"[Security Audit] Active Vulnerabilities Detected"` |
-
-#### Outputs
-
-| Name             | Description                                      |
-| :--------------- | :----------------------------------------------- |
-| `total-findings` | Total number of non-suppressed findings detected |
-| `report-file`    | Path to the generated Markdown report file       |
-
-#### Usage
-
-```yaml
-- name: Report Trivy Results
-  uses: dotsem/actions/security-report@v0.5
-  if: always() && hashFiles('trivy.sarif') != ''
-  with:
-      title: "Trivy Vulnerability Report"
-      sarif-file: "trivy.sarif"
-      comment-tag: "trivy"
-      fail-on-findings: "true"
-```
-
-### Build Flutter (`build-flutter`)
+### Build Flutter (`build`)
 
 Sets up Flutter, automatically resolves app metadata from `pubspec.yaml`, installs target dependencies, builds binaries in release, debug, or profile mode, and packages artifacts for Linux, macOS, Windows, Android (android-apk/android-aab), or iOS.
 
@@ -162,18 +72,18 @@ Sets up Flutter, automatically resolves app metadata from `pubspec.yaml`, instal
 | Name            | Description                                   |
 | :-------------- | :-------------------------------------------- |
 | `artifact-name` | Base name for the generated artifact          |
-| `artifact-path` | Path glob pointing to the packaged archive(s) |
+| `artifact-path` | Glob of the packaged archive(s), in a directory under the runner temp folder that the action owns |
 
 #### Usage
 
 ```yaml
 - name: Build Flutter App
-  uses: dotsem/actions/build-flutter@v0.5
+  uses: dotactions/flutter/build@v0.1
   with:
       target: "linux"
 ```
 
-### Setup Flutter (`setup-flutter`)
+### Setup Flutter (`setup`)
 
 Installs the Flutter SDK and runs `flutter pub get`.
 
@@ -199,13 +109,13 @@ Installs the Flutter SDK and runs `flutter pub get`.
 #### Usage
 
 ```yaml
-- uses: dotsem/actions/setup-flutter@v0.5
+- uses: dotactions/flutter/setup@v0.1
 - run: flutter analyze
 ```
 
-### Flutter Matrix (`flutter-matrix`)
+### Flutter Matrix (`matrix`)
 
-Validates Flutter targets and resolves a `strategy.matrix` (target + runner OS) and build mode for the current event. Used internally by `flutter-ci.yml` and `flutter-cd.yml`. The list of valid targets and their runners is defined in [`build-flutter/targets.json`](build-flutter/targets.json).
+Validates Flutter targets and resolves a `strategy.matrix` (target + runner OS) and build mode for the current event. Used internally by `ci.yml` and `cd.yml`. The list of valid targets and their runners is defined in [`build/targets.json`](build/targets.json).
 
 #### Inputs
 
@@ -218,7 +128,7 @@ Validates Flutter targets and resolves a `strategy.matrix` (target + runner OS)
 | `pr-build-mode`   | Build mode on `pull_request` (falls back to `"debug"`)         | No       | `""`    |
 | `push-build-mode` | Build mode on push / other events (falls back to `"release"`)  | No       | `""`    |
 
-_Provide either `targets` or both `pr-targets` and `push-targets`._
+_Provide either `targets` or both `pr-targets` and `push-targets`. Duplicate targets are rejected._
 
 #### Outputs
 
@@ -237,7 +147,7 @@ jobs:
             matrix: ${{ steps.m.outputs.matrix }}
         steps:
             - id: m
-              uses: dotsem/actions/flutter-matrix@v0.5
+              uses: dotactions/flutter/matrix@v0.1
               with:
                   targets: '["linux", "windows"]'
     build:
@@ -248,81 +158,16 @@ jobs:
                 include: ${{ fromJson(needs.matrix.outputs.matrix) }}
         steps:
             - uses: actions/checkout@v7
-            - uses: dotsem/actions/build-flutter@v0.5
+            - uses: dotactions/flutter/build@v0.1
               with:
                   target: ${{ matrix.target }}
 ```
 
 ## Workflows
 
-### Trivy Security Audit (`trivy-audit.yml`)
-
-Runs Trivy vulnerability and misconfiguration scanning on the caller repository, parses findings, publishes sticky PR comments / job summaries via `security-report`, and optionally uploads SARIF artifacts.
-
-#### Permissions Required
-
-```yaml
-permissions:
-    contents: read
-    issues: write # PR comments + issue tracking
-    pull-requests: write # optional: only if you replace the issues API with the pulls API
-```
-
-#### Inputs
-
-| Name               | Description                                | Required | Default                  |
-| :----------------- | :----------------------------------------- | :------- | :----------------------- |
-| `scan-type`        | Trivy scan target type (e.g. `fs`)         | No       | `"fs"`                   |
-| `severity`         | Comma-separated severity levels to include | No       | `"CRITICAL,HIGH,MEDIUM"` |
-| `fail-on-findings` | Fail the workflow if findings are detected | No       | `false`                  |
-| `upload-artifact`  | Upload SARIF scan report as a job artifact | No       | `true`                   |
-| `manage-issue`     | Create/update/close tracked GitHub issue   | No       | `false`                  |
-
-#### Secrets
-
-| Name    | Description                                                  | Required |
-| :------ | :----------------------------------------------------------- | :------- |
-| `token` | GitHub token with pull-requests and issues write permissions | No       |
-
-#### Usage
-
-```yaml
-# .github/workflows/security.yml
-name: Security Audit
-
-on:
-    push:
-        branches: [main]
-        paths-ignore:
-            - "**.md"
-    pull_request:
-        branches: [main]
-        paths-ignore:
-            - "**.md"
-    schedule:
-        - cron: "0 4 * * 4" # weekly Thursday at 04:00 UTC
-    workflow_dispatch:
-
-concurrency:
-    group: ${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-jobs:
-    audit:
-        uses: dotsem/actions/.github/workflows/trivy-audit.yml@v0.5
-        permissions:
-            contents: read
-            pull-requests: write
-            issues: write
-        with:
-            severity: "CRITICAL,HIGH"
-            fail-on-findings: true
-            manage-issue: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-```
-
-### Flutter CI (`flutter-ci.yml`)
+### Flutter CI (`ci.yml`)
 
-Runs Flutter static analysis, unit tests, and cross-platform compilation across a specified list of targets.
+Runs Flutter static analysis, unit tests, and cross-platform compilation across a specified list of targets. Builds start only after analysis and tests pass.
 
 #### Permissions Required
 
@@ -333,13 +178,13 @@ permissions:
 
 #### Flutter Version
 
-unless `flutter-version` is passed, the SDK version is read from `environment.flutter` in `<working-directory>/pubspec.yaml`. An exact version is recommended; a range (`^3.47.1`, `">=3.47.1 <4.0.0"`) installs its lower bound:
+Unless `flutter-version` is passed, the SDK version is read from `environment.flutter` in `<working-directory>/pubspec.yaml`. An exact version is recommended; a range (`^3.47.1`, `">=3.47.1 <4.0.0"`) installs its lower bound:
 
- ```yaml
- environment:
-     sdk: ^3.13.1
-     flutter: 3.47.1
- ```
+```yaml
+environment:
+    sdk: ^3.13.1
+    flutter: 3.47.1
+```
 
 #### Inputs
 
@@ -355,9 +200,9 @@ unless `flutter-version` is passed, the SDK version is read from `environment.fl
 | `push-build-mode`   | Build mode on push/merge (defaults to `"release"`)                          | No       | `""`**  |
 | `concurrency-tests` | Number of concurrent test runners                                           | No       | `4`     |
 
-*_You must provide either `targets` or both `pr-targets` and `push-targets`._
+\* Provide either `targets` or both `pr-targets` and `push-targets`.
 
-** _If none are provided. PR build-mode is `"debug"`, push build-mode is `"release"`._
+\*\* If none are provided, PR build mode is `"debug"` and push build mode is `"release"`.
 
 #### Usage
 
@@ -379,7 +224,7 @@ concurrency:
 
 jobs:
     ci:
-        uses: dotsem/actions/.github/workflows/flutter-ci.yml@v0.5
+        uses: dotactions/flutter/.github/workflows/ci.yml@v0.1
         with:
             pr-targets: '["android-apk"]'
             push-targets: '["android-aab", "windows"]'
@@ -392,7 +237,7 @@ jobs:
             # build-mode: 'release'
 ```
 
-### Flutter CD (`flutter-cd.yml`)
+### Flutter CD (`cd.yml`)
 
 Builds release packages across specified platforms and uploads them directly to a GitHub release.
 
@@ -405,20 +250,20 @@ permissions:
 
 #### Flutter Version
 
-unless `flutter-version` is passed, the SDK version is read from `environment.flutter` in `<working-directory>/pubspec.yaml`. An exact version is recommended; a range (`^3.47.1`, `">=3.47.1 <4.0.0"`) installs its lower bound:
+Unless `flutter-version` is passed, the SDK version is read from `environment.flutter` in `<working-directory>/pubspec.yaml`. An exact version is recommended; a range (`^3.47.1`, `">=3.47.1 <4.0.0"`) installs its lower bound:
 
- ```yaml
- environment:
-     sdk: ^3.13.1
-     flutter: 3.47.1
- ```
+```yaml
+environment:
+    sdk: ^3.13.1
+    flutter: 3.47.1
+```
 
 #### Inputs
 
 | Name                | Description                                                                 | Required | Default |
 | :------------------ | :-------------------------------------------------------------------------- | :------- | :------ |
 | `targets`           | JSON array of targets to build (e.g. `'["linux", "windows"]'`)              | Yes      | -       |
-| `tag`               | Target release tag (defaults to event tag or ref)                           | No       | `""`    |
+| `tag`               | Target release tag (required unless triggered by a release or tag push)     | No       | `""`    |
 | `flutter-version`   | Flutter SDK version (empty reads `environment.flutter` from `pubspec.yaml`) | No       | `""`    |
 | `working-directory` | Directory containing `pubspec.yaml`                                         | No       | `"."`   |
 
@@ -449,7 +294,7 @@ concurrency:
 
 jobs:
     cd:
-        uses: dotsem/actions/.github/workflows/flutter-cd.yml@v0.5
+        uses: dotactions/flutter/.github/workflows/cd.yml@v0.1
         permissions:
             contents: write
         with:
@@ -459,17 +304,6 @@ jobs:
 
 ## Releasing (maintainers)
 
-1. Merge to `main` with conventional-commit PR titles; these become the release notes.
-2. Run the **Release** workflow (`internal-release.yml`) from `main` with a version, e.g. `0.5.0` or `0.5.0-rc.1`.
-3. The workflow:
-    - rewrites every `dotsem/actions/...@main` self-reference to `@v<version>` in a detached release commit
-    - tags it `v<version>` and creates a GitHub release with generated notes
-    - moves `v0` and `v0.<minor>` to the new tag (skipped for pre-releases)
-
-Authenticates as a GitHub App (short-lived token, scoped to this repo), because `GITHUB_TOKEN` can't push commits that modify `.github/workflows/`. Requires:
-
-- repository variable `RELEASE_APP_CLIENT_ID`: the app's Client ID
-- repository secret `RELEASE_APP_PRIVATE_KEY`: the app's private key
-- app repository permissions **Contents: read & write** and **Workflows: read & write**, installed on this repo only
+Merge to `main` with conventional-commit PR titles (they become the release notes), then run the **Release** workflow (`internal-release.yml`) from `main` with a version, e.g. `1.2.0` or `1.2.0-rc.1`. It pins self-references to the release tag, creates the GitHub release and moves the floating tags; see [dotactions/tooling](https://github.com/dotactions/tooling).
 
-Bump the **minor** version for breaking changes and the **patch** version for everything else.
+Bump the **minor** version for breaking changes and the **patch** version for everything else (`0.x`).