semantic-release-pub 0.9.6 → 0.10.1

package/README.md

@@ -54,6 +54,31 @@ The plugin can be configured in the [semantic-release configuration file](https:
 
 ### `pub.dev` authentication
 
+You can publish to `pub.dev` using either GitHub Actions OIDC or Google Service Account.
+
+#### GitHub Actions OIDC
+
+The following instructions are referenced from the [documentation](https://dart.dev/tools/pub/automated-publishing#configuring-automated-publishing-from-github-actions-on-pub-dev) of Dart. Below are the key steps to allow authentication to `pub.dev` via GitHub Actions OIDC.
+
+1. Enable automated publishing.
+
+    > To complete this step, you must have uploader permission on the package or be an admin of the publisher that owns the package.
+
+    1. Navigate to the package Admin tab (pub.dev/packages/<package>/admin).
+    2. Click Enable publishing from GitHub Actions.
+    3. Then fill in the necessary information.
+   
+ 2. In your workflow, add the `id-token` permission.
+
+    ```yaml
+    jobs:
+      publish:
+        permissions:
+          id-token: write
+    ```
+
+#### Google Service Account
+
 The following instructions are referenced from the [documentation](https://dart.dev/tools/pub/automated-publishing#publish-using-exported-service-account-keys) of Dart. Below are the key steps to allow authentication to `pub.dev`.
 
 1. [Create a Google Cloud project](https://cloud.google.com/resource-manager/docs/creating-managing-projects), if you don’t have an existing project.
@@ -70,7 +95,7 @@ The following instructions are referenced from the [documentation](https://dart.
 
     > To complete this step, you must have uploader permission on the package or be an admin of the publisher that owns the package.
 
-    1. Navigate to the Admin tab (pub.dev/packages/<package>/admin).
+    1. Navigate to the package Admin tab (pub.dev/packages/<package>/admin).
     2. Click Enable publishing with Google Cloud Service account. 
     3. Type the email of the service account into the Service account email field.
         > You created this account in the previous step: `pub-dev@$PROJECT_ID.iam.gserviceaccount.com`
@@ -86,9 +111,9 @@ The following instructions are referenced from the [documentation](https://dart.
 
 ### Environment variables
 
-| Variable                     | Description                                                  |
-| ---------------------------- | ------------------------------------------------------------ |
-| `GOOGLE_SERVICE_ACCOUNT_KEY` | The google service account key created from the above steps. |
+| Variable                     | Description                                                                                             |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------- |
+| `GOOGLE_SERVICE_ACCOUNT_KEY` | The google service account key created from the above steps. Not required if using GitHub Actions OIDC. |
 
 ### Options
 
@@ -97,6 +122,7 @@ The following instructions are referenced from the [documentation](https://dart.
 | `cli`               | The `dart` or `flutter` CLI to use to publish the package to the registry.                                                                                                                                                                              | `dart`  |
 | `publishPub`        | Whether to publish the package to the registry. If set to `false`, the `pubspec.yaml` version will still be updated.                                                                                                                                    | `true`  |
 | `updateBuildNumber` | Whether to write build number for every newly bumped version in `pubspec.yaml`. Note that the build number will always be increased by one. Learn more on [Flutter docs](https://docs.flutter.dev/deployment/android#updating-the-apps-version-number). | `false` |
+| `useGithubOidc`     | Whether to use GitHub OIDC. If set to `true`, authentication to `pub.dev` will be done using GitHub OIDC. Otherwise, the `GOOGLE_SERVICE_ACCOUNT_KEY` will be used.                                                                                     | `false` |
 
 ### Examples
 
@@ -118,3 +144,20 @@ The following instructions are referenced from the [documentation](https://dart.
 ```
 
 See [here](https://github.com/zeshuaro/firestore_cache/pull/162) for a sample pull request utilising this plugin and `semantic-release` to publish a Flutter package.
+
+#### Using GitHub Actions OIDC
+
+```json
+{
+  "plugins": [
+    "@semantic-release/commit-analyzer", 
+    "@semantic-release/release-notes-generator", 
+    [
+      "semantic-release-pub",
+      {
+        "useGithubOidc": true
+      }
+    ]
+  ]
+}
+```

package/dist/publish.js

@@ -1,16 +1,15 @@
 import { execa } from "execa";
-import { getConfig, getGoogleIdentityToken, getPubspec } from "./utils.js";
+import { getConfig, getGithubIdentityToken, getGoogleIdentityToken, getPubspec, } from "./utils.js";
 const SEMANTIC_RELEASE_PUB_TOKEN = "SEMANTIC_RELEASE_PUB_TOKEN";
 export const publish = async (pluginConfig, { nextRelease: { version }, logger }) => {
-    const { cli, publishPub } = getConfig(pluginConfig);
+    const { cli, publishPub, useGithubOidc } = getConfig(pluginConfig);
     if (!publishPub) {
         logger.log(`Skipping publishing to pub.dev as publishPub is ${publishPub}`);
         return;
     }
     const pubspec = getPubspec();
-    const { GOOGLE_SERVICE_ACCOUNT_KEY } = process.env;
-    const idToken = await getGoogleIdentityToken(GOOGLE_SERVICE_ACCOUNT_KEY);
-    await setPubToken(cli, idToken);
+    const pubToken = await getPubToken(useGithubOidc, logger);
+    await setPubToken(cli, pubToken);
     logger.log(`Publishing version ${version} to pub.dev`);
     await execa(cli, ["pub", "publish", "--force"]);
     logger.log(`Published ${pubspec.name}@${version} on pub.dev`);
@@ -19,6 +18,15 @@ export const publish = async (pluginConfig, { nextRelease: { version }, logger }
         url: `https://pub.dev/packages/${pubspec.name}/versions/${version}`,
     };
 };
+const getPubToken = async (useGithubOidc, logger) => {
+    if (useGithubOidc) {
+        logger.log("Using GitHub OIDC token to publish to pub.dev");
+        return await getGithubIdentityToken();
+    }
+    logger.log("Using Google identity token to publish to pub.dev");
+    const { GOOGLE_SERVICE_ACCOUNT_KEY } = process.env;
+    return await getGoogleIdentityToken(GOOGLE_SERVICE_ACCOUNT_KEY);
+};
 const setPubToken = async (cli, idToken) => {
     process.env[SEMANTIC_RELEASE_PUB_TOKEN] = idToken;
     await execa(cli, [

package/dist/types.d.ts

@@ -2,4 +2,5 @@ export type PluginConfig = {
     cli: "dart" | "flutter";
     publishPub: boolean;
     updateBuildNumber: boolean;
+    useGithubOidc: boolean;
 };

package/dist/utils.d.ts

@@ -2,6 +2,7 @@ import { PluginConfig } from "./types.js";
 export declare const PUBSPEC_PATH = "pubspec.yaml";
 export declare const getConfig: (config: PluginConfig) => PluginConfig;
 export declare const getGoogleIdentityToken: (serviceAccountStr: string) => Promise<string>;
+export declare const getGithubIdentityToken: () => Promise<string>;
 export declare const getPubspecString: () => string;
 export declare const getPubspecFromString: (data: string) => {
     name?: string;

package/dist/utils.js

@@ -1,3 +1,4 @@
+import core from "@actions/core";
 import SemanticReleaseError from "@semantic-release/error";
 import { readFileSync } from "fs";
 import { JWT } from "google-auth-library";
@@ -8,6 +9,7 @@ const DEFAULT_CONFIG = {
     cli: "dart",
     publishPub: true,
     updateBuildNumber: false,
+    useGithubOidc: false,
 };
 const PUB_DEV_AUDIENCE = "https://pub.dev";
 export const getConfig = (config) => {
@@ -22,6 +24,9 @@ export const getGoogleIdentityToken = async (serviceAccountStr) => {
     }
     return creds.id_token;
 };
+export const getGithubIdentityToken = async () => {
+    return core.getIDToken(PUB_DEV_AUDIENCE);
+};
 export const getPubspecString = () => {
     return readFileSync(PUBSPEC_PATH, "utf-8");
 };

package/dist/verifyConditions.js

@@ -1,18 +1,33 @@
 import SemanticReleaseError from "@semantic-release/error";
 import { execa } from "execa";
-import { getConfig, getGoogleIdentityToken } from "./utils.js";
+import { getConfig, getGithubIdentityToken, getGoogleIdentityToken, } from "./utils.js";
 export const verifyConditions = async (pluginConfig, { logger }) => {
-    const { cli, publishPub } = getConfig(pluginConfig);
-    const { GOOGLE_SERVICE_ACCOUNT_KEY } = process.env;
+    const { cli, publishPub, useGithubOidc } = getConfig(pluginConfig);
     if (publishPub) {
-        if (!GOOGLE_SERVICE_ACCOUNT_KEY) {
-            throw new SemanticReleaseError("Environment variable not found: GOOGLE_SERVICE_ACCOUNT_KEY");
-        }
-        await getGoogleIdentityToken(GOOGLE_SERVICE_ACCOUNT_KEY);
+        await verifyPublishToken(useGithubOidc);
         await verifyCommand(cli);
     }
     else {
-        logger.log(`Skipping Google service account key and ${cli} CLI verification as publishPub is ${publishPub}`);
+        logger.log(`Skipping publish token and ${cli} CLI verification as publishPub is ${publishPub}`);
+    }
+};
+const verifyPublishToken = async (useGithubOidc) => {
+    if (useGithubOidc) {
+        try {
+            await getGithubIdentityToken();
+        }
+        catch (error) {
+            throw new SemanticReleaseError(`Failed to get GitHub OIDC token: ${error}`);
+        }
+    }
+    else {
+        const { GOOGLE_SERVICE_ACCOUNT_KEY } = process.env;
+        if (!GOOGLE_SERVICE_ACCOUNT_KEY) {
+            throw new SemanticReleaseError("Environment variable not found: GOOGLE_SERVICE_ACCOUNT_KEY");
+        }
+        else {
+            await getGoogleIdentityToken(GOOGLE_SERVICE_ACCOUNT_KEY);
+        }
     }
 };
 const verifyCommand = async (command) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "semantic-release-pub",
-  "version": "0.9.6",
+  "version": "0.10.1",
   "description": "semantic-release plugin to publish a Dart or Flutter package",
   "main": "dist/index.js",
   "author": "zeshuaro@gmail.com",
@@ -29,12 +29,13 @@
     "format": "ESLINT_USE_FLAT_CONFIG=false eslint --ext .ts --fix src tests && prettier --write src/**/*.ts tests/**/*.ts"
   },
   "engines": {
-    "node": ">=22.13.0"
+    "node": ">=22.13.1"
   },
   "dependencies": {
+    "@actions/core": "^1.11.1",
     "@semantic-release/error": "^4.0.0",
     "execa": "^9.5.2",
-    "google-auth-library": "^9.15.0",
+    "google-auth-library": "^9.15.1",
     "yaml": "^2.7.0",
     "zod": "^3.24.1"
   },
@@ -45,12 +46,12 @@
     "@types/semantic-release": "20.0.6",
     "@types/semantic-release__error": "3.0.3",
     "@types/signale": "1.4.7",
-    "@typescript-eslint/eslint-plugin": "8.20.0",
-    "@typescript-eslint/parser": "8.20.0",
-    "@vitest/coverage-v8": "3.0.2",
+    "@typescript-eslint/eslint-plugin": "8.21.0",
+    "@typescript-eslint/parser": "8.21.0",
+    "@vitest/coverage-v8": "3.0.4",
     "common-tags": "1.8.2",
     "conventional-changelog-conventionalcommits": "8.0.0",
-    "eslint": "9.18.0",
+    "eslint": "9.19.0",
     "eslint-config-prettier": "^10.0.1",
     "eslint-config-semistandard": "17.0.0",
     "eslint-config-standard": "17.1.0",
@@ -60,7 +61,7 @@
     "prettier": "3.4.2",
     "semantic-release": "24.2.1",
     "typescript": "5.7.3",
-    "vitest": "3.0.2",
+    "vitest": "3.0.4",
     "vitest-mock-extended": "2.0.2"
   }
 }