fix(release): publish Flutter packages via pub.dev automated publishing

.github/workflows/release.yml

@@ -220,51 +220,27 @@ jobs:
           npm publish --provenance --access public ${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}
 
   # ─── Flutter/pub.dev Release ─────────────────────────────────────────
+  # Authentication is OIDC, provisioned inside the reusable workflow -- there is
+  # no pub credential to configure here. Two consequences:
+  #
+  #   1. Each package must have tag pattern `v{{version}}` set under
+  #      Admin -> Automated publishing on pub.dev, and its `version:` in
+  #      pubspec.yaml must equal the tag's version. The versions are therefore
+  #      committed (bump them with scripts/bump-flutter-version.sh before
+  #      tagging) rather than stamped during the run.
+  #   2. pub.dev rejects automated publishing from anything but a tag push, so a
+  #      workflow_dispatch run can only ever rehearse. dry-run is forced on for
+  #      those, which is also what the dry_run input maps to on a tag push.
   flutter-release:
     name: Flutter Release
-    runs-on: ubuntu-latest
     needs: [prepare]
     if: >-
       github.event_name == 'push' ||
       github.event.inputs.modules == 'all' ||
       contains(github.event.inputs.modules, 'flutter')
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup Flutter
-        uses: subosito/flutter-action@v2
-        with:
-          channel: stable
-
-      - name: Resolve workspace dependencies
-        run: cd flutter && flutter pub get
-
-      - name: Prepare Flutter packages for publishing
-        run: |
-          chmod +x scripts/prepare-flutter-publish.sh
-          ./scripts/prepare-flutter-publish.sh "${{ needs.prepare.outputs.version }}"
-
-      - name: Publish authsome_core
-        run: |
-          cd flutter/packages/authsome_core
-          dart pub publish --force ${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}
-
-      - name: Wait for pub.dev indexing
-        if: github.event.inputs.dry_run != 'true'
-        run: sleep 45
-
-      - name: Publish authsome_flutter
-        run: |
-          cd flutter/packages/authsome_flutter
-          dart pub publish --force ${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}
-
-      - name: Wait for pub.dev indexing
-        if: github.event.inputs.dry_run != 'true'
-        run: sleep 45
-
-      - name: Publish authsome_flutter_ui
-        run: |
-          cd flutter/packages/authsome_flutter_ui
-          dart pub publish --force ${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}
+    uses: xraph/workflows/.github/workflows/pub-publish.yml@v1
+    with:
+      # Ordered: authsome_flutter depends on authsome_core, and
+      # authsome_flutter_ui depends on authsome_flutter.
+      packages: '["flutter/packages/authsome_core", "flutter/packages/authsome_flutter", "flutter/packages/authsome_flutter_ui"]'
+      dry-run: ${{ github.event_name != 'push' || github.event.inputs.dry_run == 'true' }}

flutter/packages/authsome_core/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+## 1.6.0
+
+- Release versioning is now unified across `authsome_core`, `authsome_flutter`
+  and `authsome_flutter_ui`. All three publish from a single `v{{version}}` tag
+  via pub.dev automated publishing.
+
+## 1.5.0
+
+- See the [GitHub releases](https://github.com/xraph/authsome/releases) for the
+  changes in this and earlier versions.

flutter/packages/authsome_core/pubspec.yaml

@@ -1,6 +1,6 @@
 name: authsome_core
 description: AuthSome authentication SDK for Dart — framework-agnostic core with auto-config support.
-version: 1.5.0
+version: 1.6.0
 homepage: https://github.com/xraph/authsome
 repository: https://github.com/xraph/authsome/tree/main/flutter/packages/authsome_core
 issue_tracker: https://github.com/xraph/authsome/issues

flutter/packages/authsome_flutter/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+## 1.6.0
+
+- Release versioning is now unified across `authsome_core`, `authsome_flutter`
+  and `authsome_flutter_ui`. All three publish from a single `v{{version}}` tag
+  via pub.dev automated publishing.
+- The `authsome_core` dependency constraint is now `^1.6.0`, tracking the
+  unified release version.
+
+## 1.4.0
+
+- See the [GitHub releases](https://github.com/xraph/authsome/releases) for the
+  changes in this and earlier versions.

flutter/packages/authsome_flutter/pubspec.yaml

@@ -1,6 +1,6 @@
 name: authsome_flutter
 description: AuthSome authentication SDK for Flutter — AuthProvider, SecureTokenStorage, and auto-config support.
-version: 0.1.0
+version: 1.6.0
 homepage: https://github.com/xraph/authsome
 repository: https://github.com/xraph/authsome/tree/main/flutter/packages/authsome_flutter
 issue_tracker: https://github.com/xraph/authsome/issues
@@ -14,7 +14,7 @@ resolution: workspace
 dependencies:
   flutter:
     sdk: flutter
-  authsome_core: '>=0.1.0 <2.0.0'
+  authsome_core: ^1.6.0
   flutter_secure_storage: ^9.0.0
   # Web-only typed bindings for navigator.credentials.get. The package is
   # safe to depend on cross-platform — symbols are no-ops outside of Web.

flutter/packages/authsome_flutter_ui/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+## 1.6.0
+
+- Release versioning is now unified across `authsome_core`, `authsome_flutter`
+  and `authsome_flutter_ui`. All three publish from a single `v{{version}}` tag
+  via pub.dev automated publishing.
+- Fixed the `authsome_flutter` dependency constraint, which was `^0.1.0` and so
+  could never resolve against a 1.x release. It is now `^1.6.0`.
+
+## 1.4.0
+
+- See the [GitHub releases](https://github.com/xraph/authsome/releases) for the
+  changes in this and earlier versions.

flutter/packages/authsome_flutter_ui/pubspec.yaml

@@ -1,6 +1,6 @@
 name: authsome_flutter_ui
 description: Pre-built Material Design 3 authentication UI widgets for AuthSome.
-version: 0.1.0
+version: 1.6.0
 homepage: https://github.com/xraph/authsome
 repository: https://github.com/xraph/authsome/tree/main/flutter/packages/authsome_flutter_ui
 issue_tracker: https://github.com/xraph/authsome/issues
@@ -14,7 +14,7 @@ resolution: workspace
 dependencies:
   flutter:
     sdk: flutter
-  authsome_flutter: ^0.1.0
+  authsome_flutter: ^1.6.0
 
 dev_dependencies:
   flutter_lints: ^4.0.0

scripts/bump-flutter-version.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Bumps every Dart/Flutter package to a release version in the working tree.
+#
+# RUN THIS BEFORE TAGGING AND COMMIT THE RESULT. pub.dev's automated publishing
+# matches the pushed tag against each package's `version:` in pubspec.yaml and
+# refuses the upload when they disagree, so the version has to be in the commit
+# the tag points at. CI cannot stamp it during the run -- that is the difference
+# from the old prepare-flutter-publish.sh, which mutated pubspecs mid-workflow.
+#
+# Usage: ./scripts/bump-flutter-version.sh <version>   # e.g. 1.6.0
+set -euo pipefail
+
+VERSION="${1:?Usage: bump-flutter-version.sh <version> (e.g. 1.6.0)}"
+
+if ! printf '%s' "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([-+].+)?$'; then
+  echo "error: version must be semver without a leading v, got '$VERSION'" >&2
+  exit 1
+fi
+
+PKG_DIR="$(cd "$(dirname "$0")/../flutter/packages" && pwd)"
+PACKAGES=(authsome_core authsome_flutter authsome_flutter_ui)
+
+echo "Bumping Flutter packages to $VERSION..."
+
+# perl rather than `sed -i`, whose in-place flag takes a mandatory argument on
+# BSD/macOS but not GNU. This runs on a maintainer's machine, not only on CI.
+for pkg in "${PACKAGES[@]}"; do
+  perl -pi -e "s{^version: .*}{version: $VERSION}" "$PKG_DIR/$pkg/pubspec.yaml"
+  echo "  $pkg -> $VERSION"
+done
+
+# Inter-package constraints track the release version: the three are published as
+# a set, so a dependent never wants an older sibling. Anchored on leading
+# whitespace so the `name:` key at column 0 can't match.
+perl -pi -e "s{^(\s+authsome_core:).*}{\$1 ^$VERSION}" "$PKG_DIR/authsome_flutter/pubspec.yaml"
+perl -pi -e "s{^(\s+authsome_flutter:).*}{\$1 ^$VERSION}" "$PKG_DIR/authsome_flutter_ui/pubspec.yaml"
+echo "  inter-package constraints -> ^$VERSION"
+
+echo
+echo "Done. Review, commit, then tag v$VERSION:"
+echo "  git commit -am 'chore(flutter): release $VERSION' && git tag v$VERSION && git push --follow-tags"