Publishing Dart Packages with Github Actions

A tutorial that will get you started with automated publishing of Dart packages to the pub.dev package repository, in less than 3 minutes.

In a couple of minutes from now, you will have a Github Action workflow that does all the heavy lifting of publishing your dart package or
Flutter plugin to pub.dev for you.

Let’s get started.

Get your credentials

First you need to get and setup your credentials for publishing the package. Make sure that you publish your first version manually from the command line so that your package gets listed and you become the owner of that listing.

After that, find your credentials.json file either in ~/.pub-cache or ~/<your flutter root>/.pub-cache/

$ cat ~/.pub-cache/credentials.json 
{
 “accessToken”:”<access-token>”,
 ”refreshToken”:”<refresh-token>”,
 ”tokenEndpoint”:”https://accounts.google.com/o/oauth2/token",
 "scopes":["openid","https://www.googleapis.com/auth/userinfo.email"],
 "expiration":1570721159347
}

Copy your access and refresh tokens and create secret variables in your Github project and name them
OAUTH_ACCESS_TOKEN and OAUTH_REFRESH_TOKEN respectively. They will match the names in the script below later.

Set up your Github Actions workflow

You can either choose to setup your actions direcly from the Github website or just add
this YAML configuration file
into your project and push the change to the Github repository.

/.github/workflows/dart.yml

Publishing new versions

This script will now publish a new version of your package to pub.dev every time you merge to the master branch.
It’s important to rember that each new version that you are publishing must have a new semantic version number in your pubspec.yaml and you should also declare a corresponding explanation of what you have updated in the CHANGELOG.md. The deployment will complain if you don’t.

Comments

[Chandu J S]

I've been looking for this. 😁 thanks

[Chandu J S]

do I need to worry about the expiration property?

[Dennis Alund]

No, that one is quite unimportant as my understanding of Oauth is that it only tells when first refresh of credentials should be (using the refresh token). Because if it's already expired, it still works. I'd assume that there's an instant refresh 😊