From 807d09c98100962c722bc17862cbff8e35fc3622 Mon Sep 17 00:00:00 2001
From: Justin Tout <3639630+justintout@users.noreply.github.com>
Date: Mon, 14 Sep 2026 23:23:24 -0400
Subject: [PATCH] Publish to pub.dev from a tag via trusted publishing

Publishing from CI means no long-lived pub.dev token on a developer machine.
pub.dev's trusted publishing exchanges a GitHub OIDC token for upload
authorization, so there is no secret to store or rotate.

The publish job reuses the Dart team's publish workflow and runs only after
the test workflow passes, so a tagged commit cannot ship untested.
---
 .github/workflows/publish.yml | 17 +++++++++++++++++
 .github/workflows/test.yml    |  1 +
 2 files changed, 18 insertions(+)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..19c6098
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,17 @@
+name: Publish to pub.dev
+
+on:
+  push:
+    tags:
+      # must match the tag pattern configured on pub.dev ('v{{version}}')
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+
+jobs:
+  test:
+    uses: ./.github/workflows/test.yml
+
+  publish:
+    needs: test
+    permissions:
+      id-token: write # required to authenticate via OIDC
+    uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index dd41ac0..1e2155c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
+  workflow_call:
 
 jobs:
   test: