Dart (pub.dev)
Authenticate the release with OIDC trusted publishing (recommended) or a pub.dev token.
Enable publishing#
{
"targets": {
"dart": {
"packageName": "acme",
"publish": { "pub": true }
}
}
}Trusted publishing (OIDC)#
Recommended. pub.dev supports automated publishing from GitHub Actions using the workflow's identity token, so no secret is stored.
1
Enable automated publishing on pub.dev
On pub.dev, open the package's Admin tab and enable Automated publishing → Publishing from GitHub Actions. Set:
- Repository: your linked repository (
owner/repo) - Tag pattern:
v{{version}}(the tag Scalar creates) - Environment: leave blank (unless you set
releaseEnvironment)
2
Keep the default config
{ "targets": { "dart": { "publish": { "pub": true } } } }Publishing with a token#
1
Get a pub.dev token
Obtain an OAuth/refresh token for your pub.dev account (for example with dart pub token add https://pub.dev locally and copying the stored credential).
2
Add it to the repository
Add the token as a repository secret named PUB_TOKEN. See Adding repository secrets.
3
Switch the target to token auth
{
"targets": {
"dart": {
"publish": { "pub": { "authMethod": "access-token" } }
}
}
}The workflow registers PUB_TOKEN with dart pub token add before publishing.
Notes#
- The workflow checks the pub.dev API for the version and skips publishing if it already exists.
- Trusted publishing is strongly preferred; tokens for pub.dev are longer-lived and harder to scope.