publish.yml

name: Publish

on:
  workflow_dispatch:
  push:
    tags:
      - "v*.*.*"

concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Dart
        uses: dart-lang/setup-dart@v1
        with:
          sdk: 3.9.0

      - name: Install dependencies
        run: dart pub get

      - name: Verify tag matches pubspec version
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          set -euo pipefail
          VERSION=$(grep -E '^version:' pubspec.yaml | awk '{print $2}')
          TAG="${GITHUB_REF_NAME}"

          if [ "${TAG}" != "v${VERSION}" ]; then
            echo "Tag (${TAG}) does not match pubspec.yaml version (v${VERSION})."
            exit 1
          fi

      - name: Configure pub.dev credentials
        env:
          PUB_CREDENTIALS: ${{ secrets.PUB_CREDENTIALS }}
        run: |
          set -euo pipefail
          test -n "$PUB_CREDENTIALS"
          mkdir -p "$HOME/.config/dart"
          printf '%s' "$PUB_CREDENTIALS" > "$HOME/.config/dart/pub-credentials.json"

      - name: Publish
        run: dart pub publish --force