ci: format code on pull requests and run only on PRs

.flutter-plugins-dependencies

@@ -1 +1 @@
-{"info":"This is a generated file; do not edit or check into version control.","plugins":{"ios":[{"name":"connectivity_plus","path":"/home/runner/.pub-cache/hosted/pub.dev/connectivity_plus-7.1.1/","native_build":true,"dependencies":[],"dev_dependency":false},{"name":"mobile_scanner","path":"/home/runner/.pub-cache/hosted/pub.dev/mobile_scanner-7.2.0/","shared_darwin_source":true,"native_build":true,"dependencies":[],"dev_dependency":false},{"name":"screen_capture_event","path":"/home/runner/.pub-cache/hosted/pub.dev/screen_capture_event-1.2.0/","native_build":true,"dependencies":[],"dev_dependency":false}],"android":[{"name":"connectivity_plus","path":"/home/runner/.pub-cache/hosted/pub.dev/connectivity_plus-7.1.1/","native_build":true,"dependencies":[],"dev_dependency":false},{"name":"mobile_scanner","path":"/home/runner/.pub-cache/hosted/pub.dev/mobile_scanner-7.2.0/","native_build":true,"dependencies":[],"dev_dependency":false},{"name":"screen_capture_event","path":"/home/runner/.pub-cache/hosted/pub.dev/screen_capture_event-1.2.0/","native_build":true,"dependencies":[],"dev_dependency":false}],"macos":[{"name":"connectivity_plus","path":"/home/runner/.pub-cache/hosted/pub.dev/connectivity_plus-7.1.1/","native_build":true,"dependencies":[],"dev_dependency":false},{"name":"mobile_scanner","path":"/home/runner/.pub-cache/hosted/pub.dev/mobile_scanner-7.2.0/","shared_darwin_source":true,"native_build":true,"dependencies":[],"dev_dependency":false}],"linux":[{"name":"connectivity_plus","path":"/home/runner/.pub-cache/hosted/pub.dev/connectivity_plus-7.1.1/","native_build":false,"dependencies":[],"dev_dependency":false}],"windows":[{"name":"connectivity_plus","path":"/home/runner/.pub-cache/hosted/pub.dev/connectivity_plus-7.1.1/","native_build":true,"dependencies":[],"dev_dependency":false}],"web":[{"name":"connectivity_plus","path":"/home/runner/.pub-cache/hosted/pub.dev/connectivity_plus-7.1.1/","dependencies":[],"dev_dependency":false},{"name":"mobile_scanner","path":"/home/runner/.pub-cache/hosted/pub.dev/mobile_scanner-7.2.0/","dependencies":[],"dev_dependency":false}]},"dependencyGraph":[{"name":"connectivity_plus","dependencies":[]},{"name":"mobile_scanner","dependencies":[]},{"name":"screen_capture_event","dependencies":[]}],"date_created":"2026-08-24 19:45:14.246743","version":"3.44.2","swift_package_manager_enabled":{"ios":false,"macos":false}}
+{"info":"This is a generated file; do not edit or check into version control.","plugins":{"ios":[{"name":"connectivity_plus","path":"/home/runner/.pub-cache/hosted/pub.dev/connectivity_plus-7.1.1/","native_build":true,"dependencies":[],"dev_dependency":false},{"name":"mobile_scanner","path":"/home/runner/.pub-cache/hosted/pub.dev/mobile_scanner-7.2.0/","shared_darwin_source":true,"native_build":true,"dependencies":[],"dev_dependency":false},{"name":"screen_capture_event","path":"/home/runner/.pub-cache/hosted/pub.dev/screen_capture_event-1.2.0/","native_build":true,"dependencies":[],"dev_dependency":false}],"android":[{"name":"connectivity_plus","path":"/home/runner/.pub-cache/hosted/pub.dev/connectivity_plus-7.1.1/","native_build":true,"dependencies":[],"dev_dependency":false},{"name":"mobile_scanner","path":"/home/runner/.pub-cache/hosted/pub.dev/mobile_scanner-7.2.0/","native_build":true,"dependencies":[],"dev_dependency":false},{"name":"screen_capture_event","path":"/home/runner/.pub-cache/hosted/pub.dev/screen_capture_event-1.2.0/","native_build":true,"dependencies":[],"dev_dependency":false}],"macos":[{"name":"connectivity_plus","path":"/home/runner/.pub-cache/hosted/pub.dev/connectivity_plus-7.1.1/","native_build":true,"dependencies":[],"dev_dependency":false},{"name":"mobile_scanner","path":"/home/runner/.pub-cache/hosted/pub.dev/mobile_scanner-7.2.0/","shared_darwin_source":true,"native_build":true,"dependencies":[],"dev_dependency":false}],"linux":[{"name":"connectivity_plus","path":"/home/runner/.pub-cache/hosted/pub.dev/connectivity_plus-7.1.1/","native_build":false,"dependencies":[],"dev_dependency":false}],"windows":[{"name":"connectivity_plus","path":"/home/runner/.pub-cache/hosted/pub.dev/connectivity_plus-7.1.1/","native_build":true,"dependencies":[],"dev_dependency":false}],"web":[{"name":"connectivity_plus","path":"/home/runner/.pub-cache/hosted/pub.dev/connectivity_plus-7.1.1/","dependencies":[],"dev_dependency":false},{"name":"mobile_scanner","path":"/home/runner/.pub-cache/hosted/pub.dev/mobile_scanner-7.2.0/","dependencies":[],"dev_dependency":false}]},"dependencyGraph":[{"name":"connectivity_plus","dependencies":[]},{"name":"mobile_scanner","dependencies":[]},{"name":"screen_capture_event","dependencies":[]}],"date_created":"2026-08-24 19:50:10.993714","version":"3.44.2","swift_package_manager_enabled":{"ios":false,"macos":false}}

.github/workflows/flutter_ci.yaml

@@ -2,20 +2,25 @@ name: '[CI]'
 
 on:
   pull_request:
-  # Also run on direct pushes to main. Without this, anything pushed straight
-  # to main skips CI entirely - which is how the encrypt 5.0.3 IV regression
-  # shipped despite the existing round-trip tests catching it.
-  push:
-    branches: [main]
   workflow_dispatch:
 
 jobs:
   ci:
     runs-on: ubuntu-latest
 
+    # Required by the add-and-commit step at the end.
+    permissions:
+      contents: write
+
     steps:
-      - uses: actions/checkout@v3
-
+      - uses: actions/checkout@v4
+        with:
+          # actions/checkout defaults to a detached HEAD - on pull_request it
+          # checks out the merge ref rather than the source branch - which made
+          # the commit step fail with "You are not currently on a branch".
+          # Checking the branch out by name gives it somewhere to push back to.
+          ref: ${{ github.head_ref }}
+
       - uses: subosito/flutter-action@v2
         with:
           flutter-version: "3.44.2"
@@ -26,10 +31,14 @@ jobs:
       - name: Install dependencies
         run: flutter pub get
 
-      # NOTE: `dart format --fix` was removed in newer Dart SDKs; formatting
-      # is written in place by default. Applying lint fixes is now a separate
+      # Formats in place; the commit step at the end pushes any changes back to
+      # the PR branch so the package's style stays consistent automatically.
+      #
+      # NOTE: `dart format --fix` no longer exists - the flag was removed from
+      # newer Dart SDKs and made this step fail with exit code 64. Formatting
+      # is written in place by default, and applying lint fixes is a separate
       # command (`dart fix --apply`).
-      - name: Verify formatting
+      - name: Format code
         run: dart format .
 
       - name: Analyze project source
@@ -38,8 +47,12 @@ jobs:
       - name: Run tests
         run: flutter test --no-pub
 
+      # Only meaningful on pull_request, where github.head_ref is set and the
+      # branch was checked out by name above. On workflow_dispatch there is no
+      # branch to push to.
       - uses: EndBug/add-and-commit@v9
+        if: github.event_name == 'pull_request'
         with:
-          message: Formats code
+          message: 'chore: formats code'
           committer_name: GitHub Actions
           committer_email: actions@github.com