ci: automated pub.dev publishing on version bump - #4
Merged
Conversation
Two interdependent workflows:
release.yml (push to main):
- reads version from pubspec.yaml; skips everything if tag v<version> already
exists (so it only fires on an actual bump)
- on a new version: extracts the matching CHANGELOG.md section, creates a
GitHub Release + tag v<version>, then explicitly dispatches publish.yml with
`gh workflow run publish.yml --ref v<version>` (the TAG, not a branch)
- permissions: contents: write + actions: write
- The explicit dispatch is required: a tag pushed by GITHUB_TOKEN does not
trigger other workflows' push listeners (loop prevention); workflow_dispatch
is the exemption. And it must target the tag ref, because pub.dev trusted
publishing rejects OIDC tokens with a "branch" refType.
publish.yml (tag push v*.*.* + workflow_dispatch):
- permissions: id-token: write (OIDC, no stored credentials)
- uses dart-lang/setup-dart/.github/workflows/publish.yml@v1 (handles the
pub.dev OIDC handshake)
Requires enabling Automated publishing on pub.dev (tag pattern v{{version}},
push + workflow_dispatch events). dart pub publish --dry-run: 0 warnings.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fully automated pub.dev publishing, triggered by every merge to
main. Two interdependent workflow files (in one PR, as they reference each other).release.yml— on push tomainversion:frompubspec.yaml.v<version>already exists → only fires on an actual version bump.CHANGELOG.mdblock,gh release create v<version>(Release + tag), thengh workflow run publish.yml --ref v<version>.permissions: contents: write+actions: write.publish.yml— on tagv*.*.*push +workflow_dispatchpermissions: id-token: write(OIDC, no stored secrets).uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1.The two critical GitHub Actions gotchas (both handled)
GITHUB_TOKENdoes not trigger another workflow'spush:listener (loop prevention) — sorelease.ymlexplicitly dispatchespublish.ymlviaworkflow_dispatchrather than relying on the tag push.--ref v<version>(the tag), nevermain— pub.dev trusted publishing rejects OIDC tokens whose ref refType isbranch("publishing is only allowed from 'tag' refType").Pre-flight
dart pub publish --dry-run→ 0 warnings, 377 KB.doc/(notdocs/) is.pubignored; no gitignored-but-checked-in files.The reusable workflow runs
dart pub publishwith the standalone Dart SDK.camera_prodepends on the Flutter SDK, so pub's pre-publish resolution may fail on CI (Because camera_pro depends on flutter from sdk…). If the first real publish fails there, the fix is a small custom job that sets up Flutter and runsdart pub publish --forceunder the sameid-token: writeOIDC — ready to drop in. Kept the reusable workflow here per the spec; will confirm at verification.After merge (manual, needs your pub.dev login)
Enable Automated publishing at https://pub.dev/packages/camera_pro/admin → tag pattern
v{{version}}, both push + workflow_dispatch events checked (details in the followup message).🤖 Generated with Claude Code