From 289d9422793cae9aa9000bcfdc223e850ccb7b4b Mon Sep 17 00:00:00 2001 From: Leo Farias Date: Sat, 12 Sep 2026 16:43:19 -0400 Subject: [PATCH] Restore publish validation now that pub.dev 9576 is fixed The flag was added because pub.dev returned HTTP 403 for package metadata read with a bearer token, so the OIDC-authenticated resolution that validation performs failed before the upload could start. The workflow comment recorded the exit condition: drop the flag once dart-lang/pub-dev#9576 is fixed. It is fixed. The endpoint now answers 200 with a bearer token, which upstream confirmed on 2026-09-11 and which reproduces today against this package's own advisories endpoint. --force stays: it answers the interactive confirmation a workflow cannot. Only the skipped validation comes back, so the client checks the gating dry run already performs now also run at the upload itself, where the published archive is the one being checked. --- .github/workflows/README.md | 2 +- .github/workflows/release.yml | 12 +++++------- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/.github/workflows/README.md b/.github/workflows/README.md index ff990c4..3a2432d 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -16,7 +16,7 @@ 1. **Test** — the whole of `test.yml` 2. **Release** (ubuntu) — `pkg-github-release`, `pkg-github-linux`, then - `dart pub publish --force --skip-validation` + `dart pub publish --force` 3. **Deploy macOS** — `pkg-github-macos`, then the Homebrew formula, versioned and unversioned diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0a694c6..e6f9049 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -80,14 +80,12 @@ jobs: # OIDC token for temporary pub.dev credentials, so publish directly and # keep no durable secret. # - # The `test` job that gates this one already ran `dart pub publish - # --dry-run` at this commit, so --skip-validation drops only a repeated - # client-side pass; resolving again here would authenticate the reads - # that pub.dev rejects. pub.dev still validates the archive server-side. - # Drop the flag once https://github.com/dart-lang/pub-dev/issues/9576 - # is fixed. + # --force skips the interactive confirmation, which a workflow cannot + # answer. Validation runs: dart-lang/pub-dev#9576, which rejected + # authenticated metadata reads with HTTP 403 and forced + # --skip-validation here, is fixed upstream. - name: Deploy to Pub - run: dart pub publish --force --skip-validation + run: dart pub publish --force deploy-macos: name: Deploy macOS