fix: complete repository integrity remediation

.github/actions/setup-flutter/action.yml

@@ -10,7 +10,7 @@ runs:
   using: composite
   steps:
     - name: Install Flutter
-      uses: subosito/flutter-action@v2
+      uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
       with:
         channel: stable
         flutter-version: ${{ inputs.flutter-version }}

.github/actions/setup-linux-dependencies/action.yml

@@ -10,10 +10,6 @@ inputs:
     description: Install GTK and Xvfb for desktop integration tests.
     required: false
     default: 'false'
-  coverage:
-    description: Install lcov and bc for coverage gates.
-    required: false
-    default: 'false'
   arm64:
     description: Install the AArch64 cross compiler used by release artifacts.
     required: false
@@ -26,7 +22,6 @@ runs:
       shell: bash
       env:
         DESKTOP: ${{ inputs.desktop }}
-        COVERAGE: ${{ inputs.coverage }}
         ANDROID: ${{ inputs.android }}
         ARM64: ${{ inputs.arm64 }}
       run: |
@@ -86,9 +81,6 @@ runs:
         if [[ "$DESKTOP" == 'true' ]]; then
           packages+=(libgtk-3-dev xvfb)
         fi
-        if [[ "$COVERAGE" == 'true' ]]; then
-          packages+=(bc lcov)
-        fi
         if [[ "$ARM64" == 'true' ]]; then
           packages+=(gcc-aarch64-linux-gnu g++-aarch64-linux-gnu)
         fi

.github/scripts/update_versions.dart

@@ -4,9 +4,8 @@
 /// Example: dart run .github/scripts/update_versions.dart 1.3.30 --release
 ///
 /// The optional --release flag also pins the Apple SwiftPM manifests and
-/// updates the CocoaPods podspec versions. Development checkouts may keep
-/// using the develop branch; published archives must contain an immutable
-/// dependency declaration.
+/// updates the CocoaPods podspec versions. Apple dependencies remain pinned
+/// to the repository tag carrying the same release.
 
 import 'dart:io';
 
@@ -42,6 +41,8 @@ void main(List<String> args) {
     print('Updated $path');
   }
 
+  _updateCliVersion(repoRoot, version);
+
   if (release) {
     _updateReleaseMetadata(repoRoot, version);
   }
@@ -63,12 +64,29 @@ void main(List<String> args) {
     }
   }
 
+  _verifyCliVersion(repoRoot, version);
+
   if (release) {
     _verifyReleaseMetadata(repoRoot, version);
   }
   print('All versions updated and verified.');
 }
 
+void _updateCliVersion(String root, String version) {
+  final cliRunner = File('$root/zstandard_cli/lib/src/cli_runner.dart');
+  if (!cliRunner.existsSync()) {
+    print('Error: CLI runner not found: ${cliRunner.path}');
+    exit(1);
+  }
+  cliRunner.writeAsStringSync(
+    cliRunner.readAsStringSync().replaceFirst(
+      RegExp(r"const String zstandardCliVersion = '[^']+';"),
+      "const String zstandardCliVersion = '$version';",
+    ),
+  );
+  print('Updated CLI --version to $version');
+}
+
 void _updateReleaseMetadata(String root, String version) {
   final manifests = [
     '$root/zstandard_ios/ios/zstandard_ios/Package.swift',
@@ -82,7 +100,7 @@ void _updateReleaseMetadata(String root, String version) {
     }
     var content = file.readAsStringSync();
     content = content.replaceFirstMapped(
-      RegExp(r'branch:\s*"develop"'),
+      RegExp(r'(?:branch:\s*"develop"|exact:\s*"\d+\.\d+\.\d+")'),
       (_) => 'exact: "$version"',
     );
     file.writeAsStringSync(content);
@@ -109,6 +127,15 @@ void _updateReleaseMetadata(String root, String version) {
   }
 }
 
+void _verifyCliVersion(String root, String version) {
+  final cliRunner = File('$root/zstandard_cli/lib/src/cli_runner.dart')
+      .readAsStringSync();
+  if (!cliRunner.contains("const String zstandardCliVersion = '$version';")) {
+    print('Error: CLI --version is not $version');
+    exit(1);
+  }
+}
+
 void _verifyReleaseMetadata(String root, String version) {
   final manifests = [
     '$root/zstandard_ios/ios/zstandard_ios/Package.swift',
@@ -154,12 +181,12 @@ String _updateVersionInContent(
   String version,
 ) {
   content = content.replaceFirst(
-    RegExp(r'^version:\s*[\d.]+\s*$', multiLine: true),
-    'version: $version\n',
+    RegExp(r'^version:[ \t]*[\d.]+[ \t]*$', multiLine: true),
+    'version: $version',
   );
   for (final dep in spec.deps) {
     content = content.replaceFirstMapped(
-      RegExp(r'(\s*' + dep + r':\s*)\^?[\d.]+'),
+      RegExp(r'^([ \t]*' + dep + r':[ \t]*)\^?[\d.]+[ \t]*$', multiLine: true),
       (m) => '${m[1]}^$version',
     );
   }

.github/workflows/copilot_issue.yml

@@ -4,15 +4,19 @@ on:
   issues:
     types: [opened, reopened, edited, labeled, unlabeled, assigned, unassigned]
 
+permissions:
+  contents: read
+
 jobs:
   copilot-issues:
     name: Copilot - Issue
+    if: contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association)
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
 
-      - uses: vypdev/copilot@v2
+      - uses: vypdev/copilot@274db4058088d0b2e93c807d27e24c160162d54a
         with:
           ai-ignore-files: build/*
           debug: ${{ vars.DEBUG }}

.github/workflows/copilot_issue_comment.yml

@@ -7,14 +7,15 @@ on:
 jobs:
   copilot-issues:
     name: Copilot - Issue Comment
+    if: contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
 
-      - uses: vypdev/copilot@v2
+      - uses: vypdev/copilot@274db4058088d0b2e93c807d27e24c160162d54a
         with:
           ai-ignore-files: build/*
           debug: ${{ vars.DEBUG }}

.github/workflows/copilot_pull_request.yml

@@ -1,18 +1,21 @@
 name: Copilot - Pull Request
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, reopened, edited, labeled, unlabeled, closed, assigned, unassigned, synchronize]
 
 jobs:
   copilot-pull-requests:
     name: Copilot - Pull Request
+    if: contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association)
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
 
-      - uses: vypdev/copilot@v2
+      - uses: vypdev/copilot@274db4058088d0b2e93c807d27e24c160162d54a
         with:
           ai-ignore-files: build/*
           debug: ${{ vars.DEBUG }}

.github/workflows/copilot_pull_request_comment.yml

@@ -7,19 +7,19 @@ on:
 jobs:
   copilot-pull-requests:
     name: Copilot - Pull Request Comment
+    if: contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
 
-      - uses: vypdev/copilot@v2
+      - uses: vypdev/copilot@274db4058088d0b2e93c807d27e24c160162d54a
         with:
           ai-ignore-files: build/*
           debug: ${{ vars.DEBUG }}
           opencode-model: ${{ vars.OPENCODE_MODEL }}
           project-ids: ${{ vars.PROJECT_IDS }}
           token: ${{ secrets.PAT }}
           bugbot-fix-verify-commands: ${{ vars.BUGBOT_AUTOFIX_VERIFY_COMMANDS }}
-