fix(ci): use dart-lang/setup-dart reusable workflow for OIDC publish

[kherembourg]

Summary

The previous flutter pub publish --force job hung on interactive OAuth (localhost callback) because it never performed the OIDC token exchange with pub.dev.

Switch the 3 publish jobs to call the official reusable workflow dart-lang/setup-dart/.github/workflows/publish.yml@v1, which:

• sets up dart,
• exchanges the GitHub OIDC token for pub.dev credentials,
• runs dart pub publish --force.

The validate job (with flutter pub publish --dry-run) is unchanged.

A small wait-after-purchasely job preserves the 30s sleep before publishing purchasely_google and purchasely_android_player, since they depend on purchasely_flutter and need pub.dev to have indexed it.

Prerequisite

Automated publishing has been configured on pub.dev for the 3 packages with:

• Repository: Purchasely/Purchasely-Flutter
• Tag pattern: v{{version}}
• Required GitHub Actions environment: pub.dev

Test plan

• CI green
• After merge, retag v5.7.3 to retrigger publish.yml — expect successful publish to pub.dev for the 3 packages

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR fixes the hung publish step by replacing the three custom flutter pub publish --force jobs with calls to the official dart-lang/setup-dart/.github/workflows/publish.yml@v1 reusable workflow, which performs the GitHub OIDC token exchange with pub.dev automatically. A new wait-after-purchasely job preserves the 30 s indexing delay before purchasely_google and purchasely_android_player are published in parallel.

Confidence Score: 4/5

Safe to merge; the workflow logic is correct and follows the official dart.dev recommended pattern — only minor P2 style items remain.

No P0 or P1 issues found. The OIDC wiring, environment configuration, and job dependency ordering are all correct. Two P2 findings: floating @v1 tag on the reusable workflow (supply chain hardening) and the missing explicit if guard on wait-after-purchasely.

.github/workflows/publish.yml — review the @v1 pin and the implicit skip on wait-after-purchasely.

Important Files Changed

Filename	Overview
.github/workflows/publish.yml	Replaces custom OAuth publish steps with the official dart-lang/setup-dart OIDC reusable workflow; extracts a wait-after-purchasely job to preserve the 30 s pub.dev indexing delay. Two minor P2 style items: floating @v1 tag instead of a pinned SHA, and the wait job lacks an explicit if guard.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A([Tag push / workflow_dispatch]) --> B[validate]
    B --> C{publish condition met?}
    C -- No --> Z([skip publish jobs])
    C -- Yes --> D[publish-purchasely\nOIDC via dart-lang/setup-dart]
    D --> E[wait-after-purchasely\nsleep 30s]
    E --> F[publish-google\nOIDC via dart-lang/setup-dart]
    E --> G[publish-player\nOIDC via dart-lang/setup-dart]
    F --> H[summary]
    G --> H

Loading

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
.github/workflows/publish.yml:101
**Pin reusable workflow to a commit SHA**

The `@v1` floating tag means the workflow will automatically pick up any new commits the `dart-lang` maintainers push to that tag, including potential supply-chain compromises. Pinning to a full SHA is the GitHub-recommended hardening step for third-party Actions and reusable workflows — and the pattern applies to all three `uses:` references here (`publish-purchasely`, `publish-google`, `publish-player`).

(Replace the SHA with the current HEAD of the `v1` tag at merge time.)

### Issue 2 of 2
.github/workflows/publish.yml:106-111
**`wait-after-purchasely` inherits implicit skip via `success()` — consider making it explicit**

When `publish-purchasely` is skipped (e.g. `workflow_dispatch` with `dry_run: true`), GitHub's default `if: success()` on `wait-after-purchasely` will correctly skip it too, and the downstream publish jobs follow suit. The behaviour is correct, but adding the same guard as `publish-purchasely` makes the intent self-documenting and prevents surprises if the dependency chain is ever restructured.

_{Reviews (1): Last reviewed commit: "fix(ci): use dart-lang/setup-dart reusab..." | Re-trigger Greptile}

[Copilot]

Pull request overview

Updates the pub.dev publishing workflow to use the official dart-lang/setup-dart reusable workflow so publishing can authenticate via GitHub OIDC instead of hanging on interactive OAuth.

Changes:

• Replaces the three flutter pub publish --force jobs with calls to dart-lang/setup-dart/.github/workflows/publish.yml@v1 (OIDC-based publish).
• Adds a lightweight wait-after-purchasely job to preserve the 30s delay before publishing dependent packages.
• Keeps the existing validation flow (flutter pub publish --dry-run) unchanged.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.