@mnci/cli 1.8.0 → 1.9.1

package/README.md

@@ -52,6 +52,11 @@ mnci add go-function-app fn    # serverless handler -> apps/
 mnci add go-lib core           # publishable (by git tag) -> packages/
 mnci add go-internal-lib util  # private shared package -> libs/
 
+# Flutter (@mnci/nx-flutter — one root pubspec.yaml pub workspace, analyze + test)
+mnci add flutter-app hello         # Flutter web app -> apps/ (bundle, zipped into the drop)
+mnci add flutter-lib shared        # publishable (by git tag) -> packages/
+mnci add flutter-internal-lib core # private shared package -> libs/
+
 mnci upgrade                  # re-apply the latest overlay (see below)
 mnci upgrade --agent windows-latest   # ...with an explicit override
 ```
@@ -162,15 +167,24 @@ no programmatic API yet; the two aliases are what make it work.)
 
 ## Layout convention = release scoping
 
-| Directory          | Contents                                              | Released?                              |
-| ------------------ | ----------------------------------------------------- | -------------------------------------- |
-| `apps/`            | React / Node / Python apps (plain or Azure Functions) | Never (packed into the drop)           |
-| `packages/`        | Publishable npm libraries (rollup-bundled)            | Yes — `nx release`, per-package tags   |
-| `python-packages/` | Publishable Python packages (hatchling wheels)        | Yes — `twine upload` (Azure Artifacts) |
-| `libs/`            | Internal libraries (TS or Python), never published    | Never                                  |
-
-No custom tags, no stamp file — the directory (and, for npm, the `private` flag)
-are the whole model. Publishable Python packages get their own
+| Directory          | Contents                                                       | Released?                              |
+| ------------------ | -------------------------------------------------------------- | -------------------------------------- |
+| `apps/`            | React / Node / Python / Go / Flutter apps (plain or Functions) | Never (packed into the drop)           |
+| `packages/`        | Publishable npm libraries, plus Go and Dart packages           | Yes — `nx release`, per-package tags   |
+| `python-packages/` | Publishable Python packages (hatchling wheels)                 | Yes — `twine upload` (Azure Artifacts) |
+| `libs/`            | Internal libraries (TS, Python, Go or Dart), never published   | Never                                  |
+
+The directory is very nearly the whole model — one exception, and it is a bug
+fix rather than a nicety. `go-lib` also lives in `packages/`, but a Go package
+has **no per-project manifest** (mnci puts every Go project in one root
+`go.mod`), so Nx's default `versionActions` looks for a `package.json` that is
+not there and aborts _while building the release graph_ — killing `nx release`
+for the whole workspace, not just the Go project. It is therefore excluded with
+`!tag:type:go-lib`, which is also the semantically correct call: one module
+means its packages have no independent versions to bump. A publishable **Dart**
+package in `packages/` needs no such exclusion — `pubspec.yaml` has a real
+`version:` field, and `@mnci/nx-flutter` stamps a `versionActions` override that
+reads it. Publishable Python packages get their own
 `python-packages/` dir so the npm `nx release` (`packages/*`) is never entangled
 with Python publishing.
 
@@ -291,7 +305,16 @@ lint,test,build`. Pushes to `main` then:
   the raw token twine needs for the Python publish. Skipped cleanly when there
   is nothing to release. A guarded step installs the fixed Python toolchain
   (`ruff`/`pytest`/`build`/`twine`/`pip-audit`) before any Python target runs,
-  skipped cleanly on a workspace with no Python projects.
+  skipped cleanly on a workspace with no Python projects. On a `--ci=github`
+  workspace this same step also creates a **GitHub Release per project**, with
+  a changelog Nx generates from conventional commits — `nx release` pushes the
+  tag itself here (needs `GITHUB_TOKEN`, which GitHub Actions provides for
+  free under the workflow's own `contents: write` permission), so there's no
+  separate explicit `git push origin --tags` step on this provider. `--ci=azure`
+  and `--ci=both` keep today's behaviour (no GitHub Release, explicit tag
+  push) — GitHub Release creation only turns on when GitHub Actions is the
+  _only_ configured provider, since that's the one case a `GITHUB_TOKEN` is
+  guaranteed to exist.
 
 **npm auth** is the base64 `PAT`, read the same way on both providers but from
 a different place: on Azure Pipelines, a **variable group**
@@ -370,17 +393,31 @@ fix-ci`) — `mnci` does not automate that step.
 Being upfront about what mnci leans on, so it's a conscious trade-off rather
 than a surprise:
 
-- **One Nx plugin this project builds and maintains** carries the most weight:
-  **`@mnci/nx-python-pip`** — a real Nx plugin built into this monorepo itself
-  (`packages/nx-python-pip`), created because no maintained, Nx-23-compatible
-  Python plugin supports pip (the previous Python plugin, `@nxlv/python`,
-  requires `uv`, which the company standardizing on this tool does not use, and
-  no maintained alternative supports pip). This trades third-party risk for a
-  different, real one: **this project now owns a second package's maintenance
-  surface** (generators, executors, its own release cycle) — worth being
-  explicit about, since it did not exist before. Unlike official `@nx/*`
-  plugins, if this one needs fixes or updates, this project owns those directly.
-  That's the cost of having no maintained pip-native Nx plugin in the ecosystem.
+- **Two Nx plugins this project builds and maintains** carry the most weight,
+  both for the same reason — the ecosystem has no maintained, Nx-23-compatible
+  option:
+  - **`@mnci/nx-python-pip`** (`packages/nx-python-pip`): no maintained plugin
+    supports pip. The obvious candidate, `@nxlv/python`, requires `uv`, which
+    the company standardizing on this tool does not use.
+  - **`@mnci/nx-flutter`** (`packages/nx-flutter`): `@nxrocks/nx-flutter`
+    cannot even load on Nx 23 — it imports
+    `@nx/workspace/src/utilities/fileutils`, removed in 23 — and there is no
+    alternative. Its exposure is smaller than the Python plugin's, because
+    scaffolding is delegated to the official `flutter create` rather than
+    hand-maintained templates; what this project owns is the pub-workspace
+    wiring, the targets and the release integration.
+
+  Both trade third-party risk for a different, real one: **this project owns
+  two extra packages' maintenance surface** (generators, executors, their own
+  release cycles). Unlike official `@nx/*` plugins, if either needs fixes, this
+  project owns them directly. That is the cost of the gaps in the ecosystem.
+
+- **`@nx-go/nx-go` is a third-party plugin on a declared-incompatible range.**
+  It declares `@nx/devkit ">= 20 < 23"` while this workspace runs Nx 23. That
+  range is a plain dependency rather than a peer, so npm nests its own devkit
+  copy and everything works — validated empirically against a real Nx 23.1.0
+  workspace (generators, build, test, lint). It is still a version trap worth
+  re-checking on Nx upgrades.
 - **The TS7 dual-compiler aliases pin a very new, fast-moving dependency.**
   TypeScript 7's native compiler is recent; `TS_COMPILER_DEPENDENCIES` pins
   `npm:typescript@^7.0.2` / `npm:@typescript/typescript6@^6.0.2` specifically
@@ -392,6 +429,15 @@ than a surprise:
 ## Known gaps (accepted for the experiment)
 
 - No `doctor`/`resurrect`/`spell` — out of scope until the model is proven.
+- **Flutter apps build for web only.** Android would require the Android SDK and
+  NDK on every build agent; iOS is impossible on a Linux agent regardless. Add
+  other platforms per-app with `flutter create --platforms=...` — the generated
+  `build` target only knows about web.
+- **Go has no e2e coverage.** The `go-*` kinds have real unit tests and real CI
+  wiring, but the e2e suite never drives them, because it needs Go on the
+  machine. Flutter took the opposite approach — its e2e section runs when the
+  SDK is present and reports **SKIPPED** (loudly) when it is not — so the same
+  pattern could be applied to Go, but has not been.
 - Azure Functions Core Tools is only needed for **local** `func start` — never
   for `mnci add node-function-app`/`python-function-app` generation, since
   neither shells out to the `func` CLI.
@@ -400,8 +446,13 @@ than a surprise:
   inside the published `drop` artifact is the deploy input. Deploying it means
   Azure's Oryx build installing real dependencies (`npm install`/`pip install`)
   from the zipped manifest — no `node_modules`/venv is bundled.
-- Changelog files are off (unpushable under the tag-only model); the git tag
-  history is the changelog for now.
+- Changelog **files** are off everywhere (unpushable under the tag-only
+  model — `git.commit` stays `false`, so a written `CHANGELOG.md` would just
+  be discarded at the end of every CI run). On a `--ci=github` workspace (and
+  only that one — see below) each release still gets a real changelog: Nx
+  generates it from conventional commits and posts it straight to a GitHub
+  Release, with no file ever touched. `--ci=azure` and `--ci=both` fall back
+  to the git tag history as the changelog, same as before.
 - **No lock file for Python** — plain pip has none, matching the company
   standard this migration was for. A published wheel's `Requires-Dist` mirrors
   whatever specifier the `pyproject.toml` declares (e.g. `tomli>=2.0.0`)
@@ -667,3 +718,69 @@ build` links statically, so the binary in the drop already contains
   then added to `PATH` for later steps. All three skip cleanly when the
   workspace has no root `go.mod`, and the linter install also skips when the
   agent already provides it.
+
+## Flutter (`@mnci/nx-flutter` — one root `pubspec.yaml` pub workspace)
+
+Requires the **Flutter SDK** (3.27+, for Dart 3.6+ pub workspaces) on the
+machine; `mnci add flutter-*` fails fast with an install link when `flutter` is
+not on the `PATH`. Unlike Python and Go, the SDK is **not** present on hosted
+build agents, so the generated pipeline installs it itself (see below).
+
+| Kind                   | Location          | Build / deploy                                                                                        |
+| ---------------------- | ----------------- | ----------------------------------------------------------------------------------------------------- |
+| `flutter-app`          | `apps/<name>`     | `flutter build web` bundle into `dist/apps/<name>/`, zipped into `dist/drop/flutter-app-<name>.zip`   |
+| `flutter-lib`          | `packages/<name>` | publishable **by git tag** — see below; analyze + test targets only                                   |
+| `flutter-internal-lib` | `libs/<name>`     | private shared code, analyze + test only — a Dart package is compiled into whatever app depends on it |
+
+- **Dependencies are central, via a Dart pub workspace.** One root
+  `pubspec.yaml` lists every project under `workspace:`, and each project
+  carries `resolution: workspace`. A single `flutter pub get` at the root then
+  resolves the whole graph into **one** `pubspec.lock` and **one**
+  `.dart_tool/package_config.json` — pub actively deletes any per-package
+  copies. This is the Flutter half of the same root-manifest model as the root
+  `package.json` for TS, `requirements-dev.txt` for Python and `go.mod` for Go.
+- **An internal library is consumed with a plain version constraint — no
+  `path:`.** `dependencies: { core: ^0.0.1 }` resolves to the local package
+  because it is a workspace member. That is also why Flutter needs **no
+  vendoring step**: contrast `mnci add python-vendor`, which exists only
+  because pip cannot bundle an unpublished sibling into a wheel. Flutter is in
+  the Go camp here — nothing to weave in at build time.
+- **Lint configuration is central too.** The workspace root owns one
+  `analysis_options.yaml` (including `package:flutter_lints/flutter.yaml`), and
+  each project's own file is a one-line relative `include:` of it, so a rule
+  change lands in one place.
+- **`flutter analyze --fatal-infos`, pinned explicitly.** `flutter analyze`
+  already defaults `--fatal-infos` on — verified against 3.44.8, where
+  `--no-fatal-infos` turns a failing lint run green. It is passed anyway
+  because that default is the only thing making this a real gate: nearly every
+  `flutter_lints` rule reports at _info_ severity. Worth knowing that plain
+  `dart analyze` defaults the opposite way (it fails on errors and warnings but
+  not infos), so swapping the command without carrying the flag across would
+  silently stop enforcing anything.
+- **Publishing a `flutter-lib` is a git tag, not a registry upload.** Azure
+  Artifacts has no pub/Dart feed type, so a private pub registry is not
+  available on this stack, and these packages are deliberately not pushed to
+  pub.dev. `nx release` versions and tags them; no `nx-release-publish` target
+  is written.
+- **The publishable lib carries a `versionActions` override, and it is
+  load-bearing.** Nx's default reads a `package.json`, which a Dart package
+  does not have. Without the override `nx release` aborts while building the
+  release graph — taking down the release of **every** project in the
+  workspace, not just the Dart one. The plugin's `library` generator stamps
+  `@mnci/nx-flutter/release/version-actions` on, which reads and writes
+  `pubspec.yaml`'s `version:`.
+- **Apps build for web only.** Web needs nothing beyond the Flutter SDK,
+  whereas an Android build would drag the whole Android SDK and NDK onto every
+  build agent. Other platforms can be added per-app later with
+  `flutter create --platforms=...`.
+- **CI** installs the SDK by shallow `git clone` at a pinned tag — Flutter's own
+  documented install method, and the only one uniform across agents (the
+  release archives differ by platform). It is cloned **outside** the workspace,
+  under the agent's home directory: the SDK ships dozens of its own
+  `pubspec.yaml` files, which inside the tree would pollute pub's resolution and
+  give Nx thousands of extra files to glob. The SDK version is **pinned**
+  (unlike `golangci-lint`'s `@latest`) because it determines the Dart version,
+  and pub workspaces need Dart 3.6+. Three guarded steps precede the build —
+  install, add to `PATH`, and one root `flutter pub get` — and all three skip
+  cleanly when the workspace has no root `pubspec.yaml`; the install also skips
+  when an SDK is already available.

package/dist/cli.js

@@ -164,10 +164,6 @@ function assertValidProjectName(name, label) {
   }
 }
 
-// src/commands/add/go.ts
-var import_node_fs2 = require("fs");
-var import_node_path3 = require("path");
-
 // src/commands/add/shared.ts
 var import_node_path2 = require("path");
 function hasPlugin(workspaceRoot, packageName) {
@@ -203,7 +199,48 @@ function addNxTargets(manifestPath, newTargets) {
   );
 }
 
+// src/commands/add/flutter.ts
+function ensureFlutter(workspaceRoot) {
+  if (runShell("flutter", ["--version"], workspaceRoot) !== 0) {
+    throw new Error(
+      "Flutter not found. Install the Flutter SDK first (3.27+, for Dart 3.6+ pub workspaces): https://docs.flutter.dev/get-started/install"
+    );
+  }
+}
+function nxFlutterPluginSpec() {
+  return process.env.MNCI_NX_FLUTTER_SPEC ?? "@mnci/nx-flutter";
+}
+function ensureNxFlutterPlugin(workspaceRoot) {
+  if (hasPlugin(workspaceRoot, "@mnci/nx-flutter")) {
+    return;
+  }
+  const spec = nxFlutterPluginSpec();
+  logger.step(`Installing the Flutter toolchain plugin (${spec})`);
+  if (runShell("npm", ["install", "--save-dev", spec, "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
+    throw new Error("npm install of @mnci/nx-flutter failed");
+  }
+}
+function prepareFlutter(workspaceRoot) {
+  ensureFlutter(workspaceRoot);
+  ensureNxFlutterPlugin(workspaceRoot);
+}
+function addFlutterApp(workspaceRoot, name) {
+  prepareFlutter(workspaceRoot);
+  ensureAdmZip(workspaceRoot);
+  runNx(["g", "@mnci/nx-flutter:application", name, "--no-interactive"], workspaceRoot);
+}
+function addFlutterLib(workspaceRoot, name) {
+  prepareFlutter(workspaceRoot);
+  runNx(["g", "@mnci/nx-flutter:library", name, "--no-interactive"], workspaceRoot);
+}
+function addFlutterInternalLib(workspaceRoot, name) {
+  prepareFlutter(workspaceRoot);
+  runNx(["g", "@mnci/nx-flutter:internal-library", name, "--no-interactive"], workspaceRoot);
+}
+
 // src/commands/add/go.ts
+var import_node_fs2 = require("fs");
+var import_node_path3 = require("path");
 function ensureGo(workspaceRoot) {
   if (runShell("go", ["version"], workspaceRoot) !== 0) {
     throw new Error("Go not found. Install Go 1.21+ first: https://go.dev/dl/");
@@ -539,6 +576,17 @@ export default [
           ignoredFiles: [
             '{projectRoot}/eslint.config.{js,cjs,mjs,ts,cts,mts}',
             '{projectRoot}/rollup.config.{js,ts,mjs,mts,cjs,cts}',
+            // Same reasoning as the two config files above, extended to the test
+            // toolchain: rollup bundles from the entry point only, so neither the
+            // Vitest config nor the spec files reach the published package \u2014 their
+            // imports must not drive the published manifest.
+            //
+            // Without this, a vitest-stack workspace fails \`npm run lint\` on a
+            // freshly generated npm-lib: Nx's own spec imports \`vitest\`, and
+            // @nx/dependency-checks then demands it be declared as a runtime
+            // dependency of a package that never uses it at runtime.
+            '{projectRoot}/vitest.config.{js,ts,mjs,mts,cjs,cts}',
+            '{projectRoot}/**/*.spec.{js,ts,jsx,tsx}',
           ],
         },
       ],
@@ -873,7 +921,10 @@ var PROJECT_KINDS = [
   "go-app",
   "go-function-app",
   "go-lib",
-  "go-internal-lib"
+  "go-internal-lib",
+  "flutter-app",
+  "flutter-lib",
+  "flutter-internal-lib"
 ];
 async function runAdd(kind, name, options) {
   const workspaceRoot = process.cwd();
@@ -953,6 +1004,18 @@ async function runAdd(kind, name, options) {
       addGoInternalLib(workspaceRoot, resolvedName);
       break;
     }
+    case "flutter-app": {
+      addFlutterApp(workspaceRoot, resolvedName);
+      break;
+    }
+    case "flutter-lib": {
+      addFlutterLib(workspaceRoot, resolvedName);
+      break;
+    }
+    case "flutter-internal-lib": {
+      addFlutterInternalLib(workspaceRoot, resolvedName);
+      break;
+    }
     case "python-vendor": {
       await addPythonVendor(workspaceRoot, resolvedName, options, kindProvided);
       syncProjectReferences(workspaceRoot);
@@ -1034,27 +1097,33 @@ function npmrcContent(registry, scope) {
   lines.push("");
   return lines.join("\n");
 }
-var RELEASE_CONFIG = {
-  projectsRelationship: "independent",
-  projects: ["packages/*", "python-packages/*"],
-  releaseTag: { pattern: "{projectName}@{version}" },
-  git: { commit: false, tag: true, push: false },
-  version: {
-    conventionalCommits: true,
-    fallbackCurrentVersionResolver: "disk",
-    // Build only what is being released. Without this, @nx/js:lib's generator
-    // defaults the pre-version command to building EVERY project, so a broken
-    // (or merely slow) app build would block releasing unrelated packages.
-    // Set here at `new` time it wins: the generator only fills this in when
-    // absent (it spreads the existing release.version over its default). Both
-    // globs are listed; `nx run-many` no-ops cleanly when one matches nothing.
-    preVersionCommand: "npx nx run-many -t build --projects=packages/*,python-packages/*"
-  },
-  changelog: { workspaceChangelog: false }
-};
+function releaseConfig(ci) {
+  const githubReleases = ci === "github";
+  return {
+    projectsRelationship: "independent",
+    projects: ["packages/*", "python-packages/*", "!tag:type:go-lib"],
+    releaseTag: { pattern: "{projectName}@{version}" },
+    git: { commit: false, tag: true, push: githubReleases },
+    version: {
+      conventionalCommits: true,
+      fallbackCurrentVersionResolver: "disk",
+      // Build only what is being released. Without this, @nx/js:lib's generator
+      // defaults the pre-version command to building EVERY project, so a broken
+      // (or merely slow) app build would block releasing unrelated packages.
+      // Set here at `new` time it wins: the generator only fills this in when
+      // absent (it spreads the existing release.version over its default). Both
+      // globs are listed; `nx run-many` no-ops cleanly when one matches nothing.
+      preVersionCommand: "npx nx run-many -t build --projects=packages/*,python-packages/*"
+    },
+    changelog: githubReleases ? {
+      workspaceChangelog: false,
+      projectChangelogs: { createRelease: "github", file: false }
+    } : { workspaceChangelog: false }
+  };
+}
 var SYNC_CONFIG = { applyChanges: true };
-function withReleaseConfig(nxJson) {
-  return { ...nxJson, defaultBase: "main", release: RELEASE_CONFIG };
+function withReleaseConfig(nxJson, ci) {
+  return { ...nxJson, defaultBase: "main", release: releaseConfig(ci) };
 }
 var COMMITLINT_CONFIG = `export default { extends: ['@commitlint/config-conventional'] }
 `;
@@ -1187,6 +1256,13 @@ var GOLANGCI_LINT_INSTALL_GUARD = `node -e "const fs=require('node:fs'),cp=requi
 var GO_TOOL_PATH_PRELUDE = `const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}const r=cp.spawnSync('go',['env','GOPATH'],{encoding:'utf8'});if(r.status!==0){console.log('Could not resolve GOPATH - skipping.');process.exit(0)}const bin=require('node:path').join(r.stdout.trim(),'bin');`;
 var GO_TOOL_PATH_AZURE = `node -e "${GO_TOOL_PATH_PRELUDE}console.log('##vso[task.prependpath]'+bin)"`;
 var GO_TOOL_PATH_GITHUB = `node -e "${GO_TOOL_PATH_PRELUDE}if(!process.env.GITHUB_PATH){console.log('Not running in GitHub Actions - skipping.');process.exit(0)}fs.appendFileSync(process.env.GITHUB_PATH,bin+${String.raw`'\n'`})"`;
+var FLUTTER_SDK_VERSION = "3.44.8";
+var FLUTTER_SDK_DIRECTORY_EXPRESSION = `require('node:path').join(require('node:os').homedir(),'.mnci-flutter-${FLUTTER_SDK_VERSION}')`;
+var FLUTTER_SDK_INSTALL_GUARD = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}if(cp.spawnSync('flutter',['--version'],{stdio:'ignore',shell:process.platform==='win32'}).status===0){console.log('Flutter SDK already on PATH - skipping.');process.exit(0)}const sdk=${FLUTTER_SDK_DIRECTORY_EXPRESSION};if(fs.existsSync(sdk)){console.log('Flutter SDK already installed at '+sdk+' - skipping.');process.exit(0)}process.exit(cp.spawnSync('git',['clone','--depth','1','--branch','${FLUTTER_SDK_VERSION}','https://github.com/flutter/flutter.git',sdk],{stdio:'inherit'}).status ?? 1)"`;
+var FLUTTER_TOOL_PATH_PRELUDE = `const fs=require('node:fs'),path=require('node:path');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}const sdk=${FLUTTER_SDK_DIRECTORY_EXPRESSION};if(!fs.existsSync(sdk)){console.log('Flutter SDK was not installed by mnci (already on PATH) - skipping.');process.exit(0)}const bin=path.join(sdk,'bin');`;
+var FLUTTER_TOOL_PATH_AZURE = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}console.log('##vso[task.prependpath]'+bin)"`;
+var FLUTTER_TOOL_PATH_GITHUB = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}if(!process.env.GITHUB_PATH){console.log('Not running in GitHub Actions - skipping.');process.exit(0)}fs.appendFileSync(process.env.GITHUB_PATH,bin+${String.raw`'\n'`})"`;
+var FLUTTER_PUB_GET_GUARD = `node -e "const fs=require('node:fs');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('flutter',['pub','get'],{stdio:'inherit',shell:process.platform==='win32'}).status ?? 1)"`;
 var NPM_AUDIT_STEP = "npm audit --audit-level=high || echo npm audit found vulnerabilities, see log above - non-blocking, run npm audit locally to inspect";
 var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});if(fs.globSync('apps/*/project.json').length===0){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
 function releaseGuard(pythonPublishEnv) {
@@ -1302,6 +1378,23 @@ steps:
   - script: ${GO_TOOL_PATH_AZURE}
     displayName: Add Go tool bin to PATH
 
+  # Flutter, if the workspace has any. Unlike Python and Go, hosted agents do
+  # NOT ship the Flutter SDK, so this installs it (shallow git clone at a
+  # pinned tag) and puts it on PATH. All three guards skip cleanly on a
+  # workspace with no root pubspec.yaml, and the install also skips when an
+  # SDK is already on PATH.
+  - script: ${FLUTTER_SDK_INSTALL_GUARD}
+    displayName: Install the Flutter SDK (${FLUTTER_SDK_VERSION})
+
+  - script: ${FLUTTER_TOOL_PATH_AZURE}
+    displayName: Add the Flutter SDK to PATH
+
+  # One command resolves EVERY Dart dependency, internal and external, for the
+  # whole workspace: the projects are pub workspace members, so this writes a
+  # single root pubspec.lock they all share.
+  - script: ${FLUTTER_PUB_GET_GUARD}
+    displayName: Resolve Dart dependencies (one pub get for the whole workspace)
+
   # Fails fast, with an unambiguous message, when a stale TypeScript project
   # reference (or another sync generator's drift) was never synced+committed
   # locally \u2014 sync.applyChanges (nx.json) only auto-applies interactively, so
@@ -1363,12 +1456,13 @@ steps:
     condition: ${onMain}
 `;
 }
-function githubActionsYaml(agent, pythonPublishUrl2, registryKind = "azure-artifacts") {
+function githubActionsYaml(agent, pythonPublishUrl2, registryKind = "azure-artifacts", ci = "github") {
   const onMain = `github.event_name != 'pull_request' && github.ref_name == 'main'`;
   const [npmAuthName, npmAuthValue] = npmAuthEnvVariable(
     registryKind,
     (name) => `\${{ secrets.${name} }}`
   );
+  const githubReleases = ci === "github";
   return `name: CI
 
 # Generated by MoNecromanCI. Deliberately thin: Nx builds, 'nx release'
@@ -1384,7 +1478,8 @@ on:
     branches: [main]
 
 permissions:
-  # Lets the release step push the version tag nx release creates back to main.
+  # Lets the release step push the version tag nx release creates back to main,
+  # and (github-only provider) create the GitHub Release itself.
   contents: write
 
 jobs:
@@ -1454,6 +1549,23 @@ jobs:
       - run: ${GO_TOOL_PATH_GITHUB}
         name: Add Go tool bin to PATH
 
+      # Flutter, if the workspace has any. Unlike Python and Go, hosted runners
+      # do NOT ship the Flutter SDK, so this installs it (shallow git clone at
+      # a pinned tag) and puts it on PATH. All three guards skip cleanly on a
+      # workspace with no root pubspec.yaml, and the install also skips when an
+      # SDK is already on PATH.
+      - run: ${FLUTTER_SDK_INSTALL_GUARD}
+        name: Install the Flutter SDK (${FLUTTER_SDK_VERSION})
+
+      - run: ${FLUTTER_TOOL_PATH_GITHUB}
+        name: Add the Flutter SDK to PATH
+
+      # One command resolves EVERY Dart dependency, internal and external, for
+      # the whole workspace: the projects are pub workspace members, so this
+      # writes a single root pubspec.lock they all share.
+      - run: ${FLUTTER_PUB_GET_GUARD}
+        name: Resolve Dart dependencies (one pub get for the whole workspace)
+
       # Fails fast, with an unambiguous message, when a stale TypeScript project
       # reference (or another sync generator's drift) was never synced+committed
       # locally \u2014 sync.applyChanges (nx.json) only auto-applies interactively, so
@@ -1491,13 +1603,19 @@ jobs:
       # (python-packages/*) \u2014 conventional commits, tag-only push. Portable guard:
       # nx release errors on an empty scope, so skip cleanly when there is nothing
       # to release. When there are Python packages and an Azure feed, twine
-      # publish credentials are exported (raw PAT, decoded from the base64 secret).
+      # publish credentials are exported (raw PAT, decoded from the base64 secret).${githubReleases ? `
+      # This provider also creates a per-project GitHub Release (changelog
+      # generated from conventional commits since that project's last tag),
+      # which is why 'nx release' pushes the tag itself here \u2014 see
+      # releaseConfig's remarks for why that is safe on this Nx version and
+      # why every other provider combination keeps the explicit push step below.` : ""}
       - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2))}
-        name: Release \u2014 version, tag and publish (npm + Python)
+        name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python)
         if: \${{ ${onMain} }}
         env:
-          ${npmAuthName}: ${npmAuthValue}
-
+          ${npmAuthName}: ${npmAuthValue}${githubReleases ? `
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}` : ""}
+${githubReleases ? "" : `
       # nx release's own git push (release.git.push) is deliberately left off: it
       # only runs when a remote GitHub/GitLab Release is configured, which this
       # workflow never does, so it would never push the tag the step above just
@@ -1506,7 +1624,7 @@ jobs:
       - run: git push origin --tags
         name: Push release tags (nx release's own push never runs without a remote Release configured)
         if: \${{ ${onMain} }}
-`;
+`}`;
 }
 var DEPENDABOT_CONFIG = `# Generated by MoNecromanCI. Weekly dependency-update PRs so vulnerable or
 # stale dependencies surface as a reviewable PR instead of only a push-time
@@ -1533,6 +1651,18 @@ updates:
       - "/libs/*"
     schedule:
       interval: weekly
+
+  # Same glob reasoning as pip above. Dart projects are pub workspace members,
+  # so each one declares its own dependencies even though they all resolve
+  # through the single root pubspec.lock \u2014 hence the per-project directories
+  # rather than just "/".
+  - package-ecosystem: pub
+    directories:
+      - "/apps/*"
+      - "/packages/*"
+      - "/libs/*"
+    schedule:
+      interval: weekly
 `;
 function applyOverlay(workspaceRoot, options) {
   const nxJsonPath = (0, import_node_path9.join)(workspaceRoot, "nx.json");
@@ -1543,7 +1673,10 @@ function applyOverlay(workspaceRoot, options) {
   };
   const sync = { ...nxJson.sync, ...SYNC_CONFIG };
   const mnci = { ...nxJson.mnci, ...mnciConfig(options) };
-  writeFileEnsured(nxJsonPath, toJson({ ...withReleaseConfig(nxJson), generators, sync, mnci }));
+  writeFileEnsured(
+    nxJsonPath,
+    toJson({ ...withReleaseConfig(nxJson, options.ci), generators, sync, mnci })
+  );
   const manifestPath = (0, import_node_path9.join)(workspaceRoot, "package.json");
   const manifest = readJson(manifestPath);
   const scripts = {
@@ -1580,7 +1713,7 @@ function applyOverlay(workspaceRoot, options) {
   if (options.ci === "github" || options.ci === "both") {
     writeFileEnsured(
       (0, import_node_path9.join)(workspaceRoot, ".github/workflows/ci.yml"),
-      githubActionsYaml(options.agent, publishUrl, options.registry.kind)
+      githubActionsYaml(options.agent, publishUrl, options.registry.kind, options.ci)
     );
     writeFileEnsured((0, import_node_path9.join)(workspaceRoot, ".github/dependabot.yml"), DEPENDABOT_CONFIG);
   }
@@ -1672,7 +1805,13 @@ async function runNew(name, options) {
     "  mnci add react-app web        # or: node-app, node-function-app, npm-lib, internal-lib,"
   );
   logger.info(
-    "                                 #     python-app, python-function-app, python-lib, python-internal-lib"
+    "                                 #     python-app, python-function-app, python-lib, python-internal-lib,"
+  );
+  logger.info(
+    "                                 #     go-app, go-function-app, go-lib, go-internal-lib,"
+  );
+  logger.info(
+    "                                 #     flutter-app, flutter-lib, flutter-internal-lib"
   );
   logger.info('  git add -A && git commit -m "feat: initial workspace"');
 }