feat(pub-publish): add a reusable pub.dev publish workflow - #2
Merged
Conversation
Publishes one or more Dart/Flutter packages to pub.dev from a single job in a caller-supplied order, authenticating with OIDC rather than a stored credential. dart-lang/setup-dart's publish.yml takes a single working-directory, so a repository publishing a core package plus dependents needs one job per package and gets no ordering between them. It also has no dry-run and its inputs are fixed, so a caller cannot wrap it to add one. Same reasoning as npm-publish.yml. Versions already on pub.dev are skipped rather than treated as an error, so a release whose later packages failed can be re-run without dying on the ones that already succeeded.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
pub-publish.yml, an ordered multi-package pub.dev publish workflow authenticating via OIDC.Why not call
dart-lang/setup-dart/.github/workflows/publish.ymlThat workflow takes a single
working-directory, so a repo publishing a core package plus dependents needs one job per package with no ordering between them. It has no dry-run, and its inputs are fixed, so a caller cannot wrap it to add one. This is the same reasoning recorded innpm-publish.yml.Notes
version:inpubspec.yamlmust equal the tag version. Hence noversioninput — stamping one would produce an archive pub.dev then refuses.dartshadows it — only that binary resolvessdk: flutterdeps, and it publishes pure-Dart packages too.dry-rundefaults totrue: a pub.dev version can only be retracted for 7 days and the name is never freed.Verification
actionlintclean. The publish loop was run verbatim against real pub.dev in dry-run over the threexraph/authsomeFlutter packages on a clean tree — all three exit 0.