flutter/flutter: 5 docs files hide a bidi control

In Flutter, 5 Markdown files contain U+202C, an invisible bidi control, probably pasted in with contributor names. It's the class of character Trojan Source attacks use; oss-baseline's bidi rule found all 5, and none of Flutter's own checks looks for it. This config was written to test alint; Flutter doesn't use alint.

What alint found

.alint.yml

extends:
  - alint://bundled/oss-baseline@v1
  - alint://bundled/ci/github-actions@v1
  - alint://bundled/monorepo@v1
  - alint://bundled/hygiene/no-tracked-artifacts@v1

✗ error oss-no-bidi-controls

Five Markdown files contain U+202C: docs/about/Values.md once, and 4 archived release notes in docs/releases/archive/ 20 times between them. They're probably left over from pasted contributor names.

The bundled GitHub Actions rules (alint 0.16.1, on the workflows as of 8 May 2026) flag revert.yml for declaring no permissions, one action reference not pinned to a commit, dorny/paths-filter@v3, and mirror.yml for having no name:.

The config

Flutter's framework is Dart, and its engine embeds it on each platform in that platform's language. The config extends oss-baseline, ci/github-actions, monorepo and hygiene/no-tracked-artifacts, then ports the text checks in analyze.dart: license headers in Dart and the native languages, trailing spaces, spacing after control-flow keywords and banned imports. It also checks the engine's platform directories and the flutter create templates.

.alint.yml

- id: flutter-tools-no-self-import
  kind: import_gate
  language: generic
  paths:
    include: ["packages/flutter_tools/lib/**/*.dart"]
  import_pattern: "^\\s*import\\s+'([^']+)'"
  forbid: 'package:flutter_tools/.*'
  level: error

analyze.dart checks that flutter_tools never imports itself by package name. The import_gate rule does the same, with import_pattern to teach alint Dart's import syntax.

.alint.yml

- id: flutter-engine-platform-has-build-gn
  kind: for_each_dir
  select: "engine/src/flutter/shell/platform/{android,linux,windows,fuchsia,glfw,embedder,common}"
  require:
    - kind: file_exists
      paths: "{path}/BUILD.gn"
  level: error

The engine's platform code lives in one directory per platform. Each of these seven must declare its build in a BUILD.gn.

What stays outside alint

Checks that parse code, run tests or compare images stay with Flutter's tools:

the Dart analyzer, clang-tidy, and the Java, Kotlin, Swift and Objective-C checks;
the checks in analyze.dart that read Dart syntax, such as its custom lint rules and the pairing of @Deprecated with its notice;
LUCI test runners, golden-image comparisons and binary symbol scans;
whether every platform implements the same engine interfaces. alint can't compare code across languages.