fix(release): publish Flutter packages via pub.dev automated publishing

[juicycleff]

The Flutter release job never had a pub.dev credential. dart pub publish --force without one does not fail — it prints an OAuth URL and blocks on stdin, so the job hung until GitHub cancelled it at the 6h limit (run 31342247801 burned 6h00m40s on step 6, "Publish authsome_core").

That is why authsome_core sits at 1.5.0 on pub.dev while authsome_flutter and authsome_flutter_ui are stranded at 1.4.0 — the run died before reaching them.

What changed

The hand-rolled job is replaced by xraph/workflows' pub-publish.yml@v1 (xraph/workflows#2), which authenticates over OIDC and publishes the three packages in dependency order, skipping any version already on pub.dev so a partially failed release can be re-run.

pub.dev matches the pushed tag against each version: in pubspec.yaml and refuses the upload when they disagree, so versions can no longer be stamped during the run. prepare-flutter-publish.sh is replaced by bump-flutter-version.sh, run before tagging with its result committed. The old script's two other jobs are gone as unnecessary:

• resolution: workspace publishes fine and never needed stripping.
• The sleep 45 calls for pub.dev indexing were pointless — workspace resolution resolves a sibling locally, not from the registry.

Two latent bugs this surfaced

Both were found by running the publish loop against real pub.dev on a clean tree, and both would have broken the release even with working credentials:

• dart pub publish --dry-run exits 65 on warnings, and none of the three packages had a CHANGELOG.md. Validation would have failed regardless of auth. One added per package.
• authsome_flutter_ui depended on authsome_flutter: ^0.1.0, which caps at <0.2.0 and could never resolve against a 1.x release. The old script masked this by rewriting the constraint at publish time.

Versions are unified at 1.6.0 so a single v{{version}} tag pattern covers all three, matching how the Go and npm artifacts already release.

Verification

Cloned clean, committed the changes, ran the workflow's publish loop verbatim against real pub.dev in dry-run — all three packages exit 0. actionlint clean (the one remaining release.yml warning is pre-existing, confirmed by re-running with these changes stashed).

Before merging / releasing

• pub.dev setup, per package (authsome_core, authsome_flutter, authsome_flutter_ui): Admin → Automated publishing → GitHub Actions, repo xraph/authsome, tag pattern v{{version}}.
• This must land on main before tagging v1.6.0 — the tag has to point at a commit whose pubspecs already read 1.6.0.

Note that pub.dev only accepts automated publishing from a tag push, so workflow_dispatch runs now force dry-run instead of failing at authorization. That makes dispatch a safe rehearsal.

🤖 Generated with Claude Code