Run Flutter widget code on Codename One

.github/workflows/developer-guide-docs.yml

@@ -149,7 +149,10 @@ jobs:
         if: github.event_name != 'pull_request' || steps.changes.outputs.docs == 'true' || steps.changes.outputs.demos == 'true' || steps.changes.outputs.workflow == 'true'
         run: |
           set -euo pipefail
-          xvfb-run -a mvn -B -ntp -f maven/pom.xml \
+          # Through retry.sh, transient failures only, like the demo install below:
+          # this is the step that resolves the most from Central, and a single 502
+          # on a plugin dependency (maven-shared-utils) failed the whole guide build.
+          RETRY_ONLY_MATCHING=transient xvfb-run -a bash scripts/ci/retry.sh mvn -B -ntp -f maven/pom.xml \
             -pl core,javase,android,css-compiler,codenameone-maven-plugin,backend \
             -am install \
             -Plocal-dev-javase \

.github/workflows/input-validation.yml

@@ -36,6 +36,16 @@ on:
       - 'scripts/build-ios-app.sh'
   workflow_dispatch: {}
 
+env:
+  # A method the translator culled as unreachable is still emitted as a stub,
+  # because dispatch tables name it. With this on, the stub aborts with the
+  # method's name instead of returning 0, so a wrong cull fails the suite that
+  # reached it rather than shipping a silent null. Ours to enforce, like
+  # CN1_NATIVE_VERIFY: customer builds keep the plain stub. See
+  # BytecodeMethod.appendMethodC. Not in the size or perf benchmarks, whose
+  # binaries should be the ones customers get.
+  CN1_CULL_TRAP: '1'
+
 concurrency:
   # Only the latest revision needs validation. PR numbers keep forks isolated;
   # event names keep a manual/scheduled run from cancelling a push or PR run.

.github/workflows/ios-packaging.yml

@@ -15,6 +15,16 @@ concurrency:
   group: packaging-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+env:
+  # A method the translator culled as unreachable is still emitted as a stub,
+  # because dispatch tables name it. With this on, the stub aborts with the
+  # method's name instead of returning 0, so a wrong cull fails the suite that
+  # reached it rather than shipping a silent null. Ours to enforce, like
+  # CN1_NATIVE_VERIFY: customer builds keep the plain stub. See
+  # BytecodeMethod.appendMethodC. Not in the size or perf benchmarks, whose
+  # binaries should be the ones customers get.
+  CN1_CULL_TRAP: '1'
+
 jobs:
   build-port:
     if: ${{ !inputs.port_prepared }}

.github/workflows/linux-build-run.yml

@@ -87,6 +87,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+env:
+  # A method the translator culled as unreachable is still emitted as a stub,
+  # because dispatch tables name it. With this on, the stub aborts with the
+  # method's name instead of returning 0, so a wrong cull fails the suite that
+  # reached it rather than shipping a silent null. Ours to enforce, like
+  # CN1_NATIVE_VERIFY: customer builds keep the plain stub. See
+  # BytecodeMethod.appendMethodC. Not in the size or perf benchmarks, whose
+  # binaries should be the ones customers get.
+  CN1_CULL_TRAP: '1'
+
 jobs:
   # Build the codenameone maven plugin (it needs CEF, which is x64-only on Linux)
   # and the hellocodenameone screenshot suite, then publish the suite + ads-mock
@@ -173,34 +183,14 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v6
 
-      # The native Linux port's full dependency stack: GTK3 + Cairo + Pango +
-      # GdkPixbuf + GLib/GIO (render/widgets), FontConfig/FreeType (bundled-font
-      # registration), libcurl (HTTP), GStreamer (media/camera/audio), WebKitGTK
-      # (browser), libsecret (secure storage), libnotify (notifications), GeoClue
-      # (location), libepoxy + EGL/GLES + the Mesa software driver (the offscreen
-      # 3D backend). Plus CMake/Ninja, Xvfb and a font for Pango to lay out.
-      #
-      # The GStreamer plugin set matters as much as the library: base + good carry
-      # appsrc/appsink, videoconvert and mp4mux but NO codec. VideoIO's encoder is
-      # x264enc/x265enc (plugins-ugly) parsed by h264parse/h265parse (plugins-bad)
-      # with avenc_aac for audio and avdec_* for playback (libav), so without those
-      # three packages the port has no encoder and no H.264 decoder at all.
+      # The port's full dependency stack, shared with the Flutter benchmark,
+      # which builds the same local-linux-device target. See the script for what
+      # each group is for and why the GStreamer plugin set is part of it.
       - name: Install the GTK build stack + toolchain
-        run: |
-          set -e
-          # Through the shared helper: it refreshes the index once when a .deb
-          # 404s, which is what a point release landing mid-job looks like --
-          # three openssl packages took this job out on 2026-08-25.
-          bash scripts/ci/apt-get-install.sh \
-            cmake ninja-build pkg-config unzip xvfb fonts-dejavu-core \
-            libgtk-3-dev libcairo2-dev libpango1.0-dev libgdk-pixbuf-2.0-dev libglib2.0-dev \
-            libfontconfig1-dev libfreetype-dev \
-            libcurl4-openssl-dev libssl-dev \
-            libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev gstreamer1.0-plugins-base gstreamer1.0-plugins-good \
-            gstreamer1.0-plugins-bad gstreamer1.0-plugins-ugly gstreamer1.0-libav \
-            libwebkit2gtk-4.1-dev libsecret-1-dev libnotify-dev libgeoclue-2-dev \
-            libepoxy-dev libegl1-mesa-dev libgles2-mesa-dev libgl1-mesa-dri \
-            clang time
+        run: bash scripts/ci/install-linux-native-deps.sh
+
+      - name: Install clang and time
+        run: bash scripts/ci/apt-get-install.sh clang time
 
       - name: Set up JDK 8
         uses: actions/setup-java@v5

.github/workflows/parparvm-parallel-mark.yml

@@ -135,15 +135,18 @@ jobs:
       # nothing for the tests module to resolve against, which is how the first
       # revision of this workflow failed on all three arms including the control.
       # This mirrors parparvm-tests.yml.
+      # Through retry.sh, transient failures only: a TLS handshake that did not
+      # complete fetching maven-clean-plugin from Central failed this step once,
+      # before anything under test had been built.
       - name: Build JavaAPI and the translator
-        run: mvn -B clean package -pl JavaAPI -am -DskipTests
+        run: RETRY_ONLY_MATCHING=transient bash ../scripts/ci/retry.sh mvn -B clean package -pl JavaAPI -am -DskipTests
         working-directory: vm
 
       - name: GC suite
         env:
           CN1_TEST_EXTRA_CFLAGS: ${{ matrix.cflags }}
         run: |
-          mvn -B test -pl tests -am \
+          RETRY_ONLY_MATCHING=transient bash ../scripts/ci/retry.sh mvn -B test -pl tests -am \
             -Dsurefire.failIfNoSpecifiedTests=false \
             -Dtest='GcHeapIntegrityIntegrationTest,GcOverflowSpiralIntegrationTest,GcUncooperativeThreadIntegrationTest,LargeArrayGcIntegrationTest,LowMemoryThrottleIntegrationTest,BibopPageFloorIntegrationTest'
         working-directory: vm

.github/workflows/parparvm-selfhost.yml

@@ -44,6 +44,14 @@ concurrency:
 
 env:
   CN1_NATIVE_VERIFY: strict
+  # A method the translator culled as unreachable is still emitted as a stub,
+  # because dispatch tables name it. With this on, the stub aborts with the
+  # method's name instead of returning 0, so a wrong cull fails the suite that
+  # reached it rather than shipping a silent null. Ours to enforce, like
+  # CN1_NATIVE_VERIFY: customer builds keep the plain stub. See
+  # BytecodeMethod.appendMethodC. Not in the size or perf benchmarks, whose
+  # binaries should be the ones customers get.
+  CN1_CULL_TRAP: '1'
 
 jobs:
   selfhost:

.github/workflows/parparvm-tests-windows.yml

@@ -81,6 +81,14 @@ env:
   # the translator so a customer build that succeeds today keeps succeeding; see
   # NativeSignatureVerifier.
   CN1_NATIVE_VERIFY: strict
+  # A method the translator culled as unreachable is still emitted as a stub,
+  # because dispatch tables name it. With this on, the stub aborts with the
+  # method's name instead of returning 0, so a wrong cull fails the suite that
+  # reached it rather than shipping a silent null. Ours to enforce, like
+  # CN1_NATIVE_VERIFY: customer builds keep the plain stub. See
+  # BytecodeMethod.appendMethodC. Not in the size or perf benchmarks, whose
+  # binaries should be the ones customers get.
+  CN1_CULL_TRAP: '1'
 
 jobs:
   vm-tests-windows:
@@ -359,11 +367,26 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: '8'
-          cache: 'maven'
       - name: Save JDK 8 path
         shell: pwsh
         run: echo "JDK_8_HOME=$env:JAVA_HOME" >> $env:GITHUB_ENV
 
+      # The Maven repository, restored from the NEAREST earlier run rather than an
+      # exact match. setup-java's cache: 'maven' keys on the hash of every pom.xml
+      # and restores nothing on a miss, so any change to a pom started this job
+      # from an empty repository -- and Central rate-limits Windows runners hard:
+      # one such run got 429 Too Many Requests on junit-bom through all five
+      # attempts of the retry loop below, over ten minutes, before building
+      # anything. A near match already holds almost every artifact, so the few new
+      # ones are all that has to come from Central.
+      - name: Maven repository cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.m2/repository
+          key: maven-${{ runner.os }}-screenshot-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            maven-${{ runner.os }}-screenshot-
+
       # Install the locally-built artifacts the hellocodenameone Maven build needs:
       # codename1-core + the Windows port (translator inputs), the codenameone
       # maven plugin (runs transcode-svg / css / annotation processing during the

.github/workflows/parparvm-tests.yml

@@ -92,6 +92,14 @@ env:
   # the translator so a customer build that succeeds today keeps succeeding; see
   # NativeSignatureVerifier.
   CN1_NATIVE_VERIFY: strict
+  # A method the translator culled as unreachable is still emitted as a stub,
+  # because dispatch tables name it. With this on, the stub aborts with the
+  # method's name instead of returning 0, so a wrong cull fails the suite that
+  # reached it rather than shipping a silent null. Ours to enforce, like
+  # CN1_NATIVE_VERIFY: customer builds keep the plain stub. See
+  # BytecodeMethod.appendMethodC. Not in the size or perf benchmarks, whose
+  # binaries should be the ones customers get.
+  CN1_CULL_TRAP: '1'
 
 jobs:
   # EVERY DOCUMENTED RUNTIME CONFIGURATION MUST STILL COMPILE.

.github/workflows/perf-baseline.yml

@@ -1,5 +1,10 @@
 name: Performance baselines
 
+# Two gates keep their baselines this way, with one set of rules
+# (vm/selfhost/perf_baseline.py): the ParparVM performance gate in
+# vm/selfhost/perf-baseline/, and the Flutter benchmark's regression gate in
+# scripts/flutter-bench/baseline/ (scripts/flutter-bench/flutter_baseline.py).
+#
 # The ParparVM performance gate's baselines live in vm/selfhost/perf-baseline/:
 # base/ holds the consolidated rows, and each pull request that changes a baseline
 # writes only its own pr/<number>.json, so baseline changes stay in the pull
@@ -49,16 +54,25 @@ jobs:
         working-directory: vm/selfhost
         run: python3 -m unittest test_perf_gate
 
+      - name: The Flutter benchmark gate's unit tests
+        working-directory: scripts/flutter-bench
+        run: python3 -m unittest test_flutter_baseline
+
       - name: Check the baselines
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
+          # Both, even when the first fails, so one comment shows every problem.
+          status=0
           if [ -n "${BASE_SHA}" ]; then
-            python3 vm/selfhost/perf_baseline.py check --base "${BASE_SHA}" --pr "${PR_NUMBER}"
+            python3 vm/selfhost/perf_baseline.py check --base "${BASE_SHA}" --pr "${PR_NUMBER}" || status=1
+            python3 scripts/flutter-bench/flutter_baseline.py check --base "${BASE_SHA}" --pr "${PR_NUMBER}" || status=1
           else
-            python3 vm/selfhost/perf_baseline.py check
+            python3 vm/selfhost/perf_baseline.py check || status=1
+            python3 scripts/flutter-bench/flutter_baseline.py check || status=1
           fi
+          exit $status
 
   fold:
     if: (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/master'
@@ -87,14 +101,15 @@ jobs:
             git fetch --quiet origin master
             git reset --quiet --hard origin/master
             python3 vm/selfhost/perf_baseline.py fold
-            git add -A vm/selfhost/perf-baseline
+            python3 scripts/flutter-bench/flutter_baseline.py fold
+            git add -A vm/selfhost/perf-baseline scripts/flutter-bench/baseline
             if git diff --staged --quiet; then
               echo "No overlays to fold."
               echo "folded=false" >> "$GITHUB_OUTPUT"
               exit 0
             fi
             git diff --staged --stat
-            git commit --quiet -m "ci: fold merged performance baselines into perf-baseline/base"
+            git commit --quiet -m "ci: fold merged performance and Flutter benchmark baselines into base/"
             if git push origin HEAD:master; then
               echo "folded=true" >> "$GITHUB_OUTPUT"
               exit 0

.github/workflows/pr.yml

@@ -153,6 +153,14 @@ env:
   # outcome of customer builds that succeed today, so it is ours to enforce, not
   # theirs to trip over. See NativeSignatureVerifier.
   CN1_NATIVE_VERIFY: strict
+  # A method the translator culled as unreachable is still emitted as a stub,
+  # because dispatch tables name it. With this on, the stub aborts with the
+  # method's name instead of returning 0, so a wrong cull fails the suite that
+  # reached it rather than shipping a silent null. Ours to enforce, like
+  # CN1_NATIVE_VERIFY: customer builds keep the plain stub. See
+  # BytecodeMethod.appendMethodC. Not in the size or perf benchmarks, whose
+  # binaries should be the ones customers get.
+  CN1_CULL_TRAP: '1'
 
 concurrency:
   # Only the latest revision needs validation. PR numbers keep forks isolated;

.github/workflows/release.yml

@@ -359,6 +359,46 @@ jobs:
           [ "$code" = "200" ] || { echo "MISSING on R2: codenameone-guibuilder (HTTP $code)" >&2; exit 1; }
           echo "ok: codenameone-guibuilder ${GITHUB_REF_NAME} on R2"
 
+      # --- Flutter runtime and Dart runtime -----------------------------------
+      # codenameone-dart-runtime and codenameone-flutter-runtime compile at
+      # release 17, so the maven/ reactor only includes them on JDK 17 (the
+      # flutter-modules profile) and the JDK 8 core pass above never builds them.
+      # Without this pass a project that declares codenameone-flutter-runtime at a
+      # released version -- as the archetype documentation says to -- cannot
+      # resolve it. The transpiler itself builds on JDK 8 and ships with the core.
+      - name: Build and stage the Flutter runtimes
+        id: deploy_flutter
+        continue-on-error: true
+        if: >-
+          always() && (steps.deploy.outcome == 'success' ||
+          steps.r2_core.outcome == 'success')
+        run: |
+          export GPG_TTY=$(tty)
+          cd maven
+          # -pl without -am: the parent and core were released above and are in
+          # the local repository at this version; re-staging them here would
+          # produce new signatures for artifacts that are already immutable on R2.
+          # With -pl the plugin stages under the FIRST reactor module's target --
+          # maven/dart-runtime/target/central-staging, holding both runtimes --
+          # not under maven/target, so the core tree is left untouched.
+          xvfb-run -a mvn deploy -Psign-artifacts -Dgpg.passphrase=$MAVEN_GPG_PASSPHRASE \
+            -pl dart-runtime,flutter-runtime -DskipTests -DskipPublishing=true
+        env:
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+
+      - name: Publish Flutter runtimes to R2
+        id: r2_flutter
+        continue-on-error: true
+        if: always() && steps.deploy_flutter.conclusion != 'skipped'
+        run: |
+          bash maven/scripts/r2/publish-staging-to-r2.sh maven/dart-runtime/target/central-staging
+          for artifact in codenameone-dart-runtime codenameone-flutter-runtime; do
+            url="${R2_BASE_URL}/com/codenameone/${artifact}/${GITHUB_REF_NAME}/${artifact}-${GITHUB_REF_NAME}.pom?cb=${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+            code=$(curl -s -o /dev/null -w "%{http_code}" "$url")
+            [ "$code" = "200" ] || { echo "MISSING on R2: $artifact (HTTP $code)" >&2; exit 1; }
+            echo "ok: $artifact ${GITHUB_REF_NAME} on R2"
+          done
+
       - name: Mark the R2 release complete
         id: r2_mark_complete
         continue-on-error: true
@@ -387,12 +427,14 @@ jobs:
           steps.deploy_certificatewizard.outcome == 'success' &&
           steps.deploy_settings.outcome == 'success' &&
           steps.deploy_guibuilder.outcome == 'success' &&
+          steps.deploy_flutter.outcome == 'success' &&
           steps.r2_core.outcome == 'success' &&
           steps.r2_core_confirm.outcome == 'success' &&
           steps.r2_gamebuilder.outcome == 'success' &&
           steps.r2_certificatewizard.outcome == 'success' &&
           steps.r2_settings.outcome == 'success' &&
-          steps.r2_guibuilder.outcome == 'success'
+          steps.r2_guibuilder.outcome == 'success' &&
+          steps.r2_flutter.outcome == 'success'
         run: bash maven/scripts/r2/mark-release-complete.sh "${GITHUB_REF_NAME}"
 
       - name: Regenerate R2 metadata and archetype catalog
@@ -445,12 +487,14 @@ jobs:
           bad "${{ steps.deploy_certificatewizard.outcome }}" && fail "Signing Wizard build"
           bad "${{ steps.deploy_settings.outcome }}" && fail "Settings build"
           bad "${{ steps.deploy_guibuilder.outcome }}" && fail "GUI Builder build"
+          bad "${{ steps.deploy_flutter.outcome }}" && fail "Flutter runtimes build"
           bad "${{ steps.r2_core.outcome }}" && fail "core reactor -> R2"
           bad "${{ steps.r2_core_confirm.outcome }}" && fail "core artifacts missing on R2"
           bad "${{ steps.r2_gamebuilder.outcome }}" && fail "Game Builder -> R2"
           bad "${{ steps.r2_certificatewizard.outcome }}" && fail "Signing Wizard -> R2"
           bad "${{ steps.r2_settings.outcome }}" && fail "Settings -> R2"
           bad "${{ steps.r2_guibuilder.outcome }}" && fail "GUI Builder -> R2"
+          bad "${{ steps.r2_flutter.outcome }}" && fail "Flutter runtimes -> R2"
           bad "${{ steps.r2_mark_complete.outcome }}" && fail "marking the R2 release complete"
           bad "${{ steps.r2_metadata.outcome }}" && fail "R2 metadata regeneration"
           # A skipped marker is not a legitimate skip: it is how a release ends up

.github/workflows/scripts-ios-native.yml

@@ -15,6 +15,16 @@ concurrency:
   group: native-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+env:
+  # A method the translator culled as unreachable is still emitted as a stub,
+  # because dispatch tables name it. With this on, the stub aborts with the
+  # method's name instead of returning 0, so a wrong cull fails the suite that
+  # reached it rather than shipping a silent null. Ours to enforce, like
+  # CN1_NATIVE_VERIFY: customer builds keep the plain stub. See
+  # BytecodeMethod.appendMethodC. Not in the size or perf benchmarks, whose
+  # binaries should be the ones customers get.
+  CN1_CULL_TRAP: '1'
+
 jobs:
   build-port:
     if: ${{ !inputs.port_prepared }}

.github/workflows/scripts-ios.yml

@@ -127,6 +127,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+env:
+  # A method the translator culled as unreachable is still emitted as a stub,
+  # because dispatch tables name it. With this on, the stub aborts with the
+  # method's name instead of returning 0, so a wrong cull fails the suite that
+  # reached it rather than shipping a silent null. Ours to enforce, like
+  # CN1_NATIVE_VERIFY: customer builds keep the plain stub. See
+  # BytecodeMethod.appendMethodC. Not in the size or perf benchmarks, whose
+  # binaries should be the ones customers get.
+  CN1_CULL_TRAP: '1'
+
 jobs:
   select:
     runs-on: ubuntu-24.04