Use workflow_run trigger with artifact for safe tag passing

Author: leehack

.github/workflows/publish-on-release.yml

@@ -1,21 +1,40 @@
 name: Publish to pub.dev
 
 on:
-  release:
-    types: [published]
+  workflow_run:
+    workflows: ["Create Release"]
+    types: [completed]
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    # Only run if the triggering workflow succeeded
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     permissions:
       id-token: write # Required for authentication using OIDC
     steps:
+      - name: Download tag artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: release-tag
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Get tag from artifact
+        id: get-tag
+        run: |
+          TAG=$(cat tag.txt)
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "🏷️ Tag from artifact: $TAG"
+
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.get-tag.outputs.tag }}
 
       - name: Determine package from tag
         id: package-info
         run: |
-          TAG="${{ github.ref_name }}"
+          TAG="${{ steps.get-tag.outputs.tag }}"
           echo "🏷️ Processing tag: $TAG"
           
           if [[ "$TAG" == mcp_dart_cli-v* ]]; then

.github/workflows/publish.yml

@@ -68,3 +68,13 @@ jobs:
           name: ${{ inputs.package }} ${{ steps.get-version.outputs.version }}
           generate_release_notes: true
           draft: false
+
+      - name: Save tag for publish workflow
+        run: echo "${{ steps.create-tag.outputs.tag }}" > tag.txt
+
+      - name: Upload tag artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-tag
+          path: tag.txt
+          retention-days: 1