Publish to pub.dev from a tag via trusted publishing

[justintout]

Publishes on a version tag using pub.dev's trusted publishing, so there is no pub.dev token stored on a developer machine. pub.dev exchanges a GitHub OIDC token for upload authorization instead.

publish.yml runs on tags matching v[0-9]+.[0-9]+.[0-9]+, waits for the test workflow, then calls the Dart team's reusable publish workflow. test.yml gains workflow_call so the publish job can depend on it. A tagged commit cannot ship untested as a result.

Setup required before the first tag

The workflow alone is not enough. pub.dev has to know it should trust this repository. That is a web UI setting I cannot make:

1. Go to https://pub.dev/packages/cronparse/admin.
2. Under Automated publishing, choose Enable publishing from GitHub Actions.
3. Repository: justintout/cronparse
4. Tag pattern: v{{version}}

The package already exists on pub.dev (0.1.1), which is the prerequisite. pub.dev only allows automating publishing for existing packages.

Optionally, tick Require GitHub Actions environment and name it pub.dev, then create a matching environment in the repository settings and add environment: pub.dev to the publish job. That prevents anyone with tag-push access from publishing without the environment's protection rules. Not enabled here, since the repository has a single maintainer.

Publishing 0.2.0

Once the pub.dev setting is in place:

git tag v0.2.0
git push origin v0.2.0

pubspec.yaml is already at 0.2.0, which must match the tag. Progress appears under the repository's Actions tab, and the publish is recorded in pub.dev's audit log.