publish.yaml

on:
  workflow_call:
    inputs:
      package-path:
        description: The path to the package to publish
        default: '.'
        type: string

      sdk:
        description: See https://github.com/dart-lang/setup-dart
        default: 2.19.6
        type: string

permissions:
  contents: write
  id-token: write
  pull-requests: write

jobs:
  sbom:
    name: Create SBOM Release Asset
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dart-lang/setup-dart@v1
        with:
          sdk: ${{ inputs.sdk }}
      - working-directory: ${{ inputs.package-path }}
        run: dart pub get
      - name: Publish SBOM to Release Assets
        uses: anchore/sbom-action@v0
        with:
          path: ./
          format: cyclonedx-json

  publish:
    name: Publish to pub.dev
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dart-lang/setup-dart@v1
        id: setup-dart
        with:
          sdk: ${{ inputs.sdk }}

      - name: Install dependencies
        run: dart pub get

      # For dart 2, we have to force publish because `analyze --fatal-infos` is ran.
      # This was fixed in dart 3, so we don't need to force publish for this version
      - name: Publish (dart 2)
        if: startsWith(steps.setup-dart.outputs.dart-version, '2')
        run: dart pub publish --force

      - name: Publish (dart 3)
        if: startsWith(steps.setup-dart.outputs.dart-version, '3')
        run: dart pub publish