[sjungwon03]

Summary

Promotes dev to main for LabFox 0.1.10+12. This release includes the GitLab workflow and mobile-web parity changes integrated since 0.1.9, plus #667, which removes LabFox subscriptions, ads, and feature gates so every supported platform provides the full app for free.

Merging this pull request triggers release.yml: it reruns formatting, analysis, and all package tests; builds the Windows installer and portable archive; uploads iOS build 12 to App Store Connect without submitting it for review; uploads Android build 12 to the Google Play internal track; then creates tag v0.1.10 and publishes the GitHub release. The release stops if a required job fails.

Validation

• PR feat(app): make all features free and remove ads #667 was approved, passed the Flutter quality gate and iOS SDK validation, and was merged into dev.
• PR docs(store): summarize 0.1.10 features #670 updated the English and Korean release notes, passed CI, and was merged into dev.
• The free, ad-free change passed 8,592 local tests, flutter analyze, formatting, Android debug APK and release AAB builds. The debug APK declares no advertising ID permission.
• dev contains version: 0.1.10+12 and English and Korean 0.1.10 release notes.
• No v0.1.10 tag or existing open dev to main release PR was present when this PR was opened.

After the automated release

Update the App Store Connect What's New field from docs/store/release-notes.md and submit the build for review. Promote the Google Play internal release to production in Play Console when ready. Update store privacy and pricing declarations to reflect the removal of subscriptions and ads. The macOS store package remains manual per RELEASING.md.

Focused review before approval

The promotion spans many previously integrated feature PRs. Please review these areas against the main...dev diff and the relevant feature PRs before approving this release:

• MR discussions, diff positions, suggestions, and private pending reviews: account/project/MR/version identity, publish/retry behavior, and destructive actions.
• Package and container registries: delete confirmations, retention and immutable-tag rules, permission failures, and API parameter mapping.
• Protected branches, tags, and environments: inherited-rule handling, role changes, approval groups, and confirmation before removal.
• Pipeline jobs and schedules, releases and milestones, wiki, and navigation: pagination, account scope, and action refresh after mutations.
• Free and ad-free conversion: no purchase or ad SDK startup, platform permissions, feature gates, privacy copy, and release metadata.

The store-note correction requested in the first review landed in dev through #670. The route-analytics privacy blocker was fixed with regression tests, approved, and merged into dev through #672. A later focused review found that GitLab release deletion returns 200 OK but LabFox accepted only 204; test-first fix #674 passed CI, was approved, and merged into dev. The latest review found cross-account state leakage in container repository deletion; test-first fix #676 passed CI and awaits review and merge into dev. Focused review of the remaining promotion diff is still requested before release approval.

[sjungwon03-ai]

Review notes

Verdict: Comment

• docs/store/release-notes.md:25 — The 0.1.10 notes describe free access and ad removal but omit the newly shipped MR review and draft workflows, registry tooling, and protection-management screens; add a concise user-facing summary of the major additions before copying the notes into the stores.

Checks: Promotion CI passed formatting, analysis, app and package tests, generated-code verification, language policy, and the unsigned iOS build; local git diff --check passed. Flutter is unavailable locally. Review covered release configuration, monetization removal, selected API and review flows, and associated tests, not the complete 1,147-file promotion diff; obtain focused review of the remaining changes before treating this as release approval.

[sjungwon03-ai]

Required changes

Verdict: Changes requested

1. apps/labfox/lib/core/analytics/analytics.dart:81 — The new release, container-tag, and protection-detail routes embed private tag, branch, or environment names, but sanitizeRoute only masks numbers and commit parameters, so visiting /projects/42/protected_branches/customer-secret sends /projects/:id/protected_branches/customer-secret to OpenPanel; replace every dynamic route value with a route-template placeholder and add regression tests for these new routes before releasing.

Checks: All reported checks are terminal and successful or skipped; CI verified formatting, analysis, tests, generated code, language policy, and the unsigned iOS build; local git diff --check passed, but Flutter/Dart are unavailable locally. Focused review found this privacy blocker; the remaining promotion scope still needs review.

[sjungwon03-ai]

Required changes

Verdict: Changes requested

1. packages/gitlab_api/lib/src/releases/releases_api.dart:206 — ReleasesApi.delete accepts only 204, but GitLab returns 200 OK with the deleted release (confirmed by its official API documentation and upstream request specs), so successful deletion throws and bypasses the controller cache refresh; accept the documented success response and add API/controller regression coverage using 200 rather than only the existing mocked 204.

Checks: All reported GitHub checks are terminal and successful or skipped, including the Flutter quality gate and iOS SDK validation; local git diff --check passed. Flutter/Dart are unavailable locally, so no local Dart tests were run. This focused review checked the analytics fix and selected review, pagination, registry, schedule, and release flows; it is not approval of the complete promotion diff.

[sjungwon03-ai]

Required changes

Verdict: Changes requested

1. apps/labfox/lib/features/container_registry/presentation/controllers/container_repository_delete_controller.dart:9 — The non-auto-disposed controller retains true after scheduling deletion but neither watches the active account nor includes it in RegistryRef, so switching to another GitLab instance with the same project/repository IDs falsely labels its unrelated repository as deletion-scheduled and disables deletion and navigation; scope this state to the authenticated account/session and add a two-instance regression test.

Checks: All reported GitHub checks are terminal and successful or skipped; local git diff --check passed. Flutter/Dart are unavailable locally, so no local Flutter tests were run. The previous release-deletion response fix and its API/cache-refresh tests were inspected; this focused review also covered selected protection, registry, environment, and pending-review paths, not the entire promotion diff.