From 79756efef05c3ccbafa1440e5be4a140690ce6da Mon Sep 17 00:00:00 2001
From: "unicoderbot[bot]" <269805761+unicoderbot[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 13:48:43 +0000
Subject: [PATCH 1/4] fix(dart_pub_publish): make pub_credentials optional for
 OIDC publishing

Closes #540

Co-authored-by: marcossevilla <marcossevilla@users.noreply.github.com>
---
 .github/workflows/dart_pub_publish.yml  | 9 ++++++++-
 site/docs/workflows/dart_pub_publish.md | 6 ++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dart_pub_publish.yml b/.github/workflows/dart_pub_publish.yml
index 3e6be53..3830f99 100644
--- a/.github/workflows/dart_pub_publish.yml
+++ b/.github/workflows/dart_pub_publish.yml
@@ -20,13 +20,20 @@ on:
         required: false
         type: number
         default: 5
+      environment:
+        required: false
+        type: string
+        default: ""
+        description: "The GitHub deployment environment to run the publish job in."
     # Deprecated, will be used if passed in but using the "Setup Dart" action is recommended
     secrets:
       pub_credentials:
-        required: true
+        required: false
 
 jobs:
   publish:
+    environment: ${{inputs.environment}}
+
     defaults:
       run:
         working-directory: ${{inputs.working_directory}}
diff --git a/site/docs/workflows/dart_pub_publish.md b/site/docs/workflows/dart_pub_publish.md
index c47573c..798601e 100644
--- a/site/docs/workflows/dart_pub_publish.md
+++ b/site/docs/workflows/dart_pub_publish.md
@@ -43,6 +43,12 @@ This workflow uses the automated publishing of packages to pub.dev which is part
 
 **Default** `5`
 
+### `environment`
+
+**Optional** The [GitHub deployment environment](https://dart.dev/tools/pub/automated-publishing#hardening-security-with-github-deployment-environments) to run the publish job in. Leave empty to run without a deployment environment.
+
+**Default** `""`
+
 ## Example Usage
 
 ```yaml

From 2a46a5c1027c1c6f97650981b8ba906b8f0111da Mon Sep 17 00:00:00 2001
From: "unicoderbot[bot]" <269805761+unicoderbot[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 13:58:54 +0000
Subject: [PATCH 2/4] fix(ci): address failing checks on PR #541 (attempt 1/3)

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7a6958c..c4796df 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -122,6 +122,7 @@ jobs:
     with:
       scopes: |
         dart_package
+        dart_pub_publish
         deps
         flutter_package
         jaspr_site

From 8b2c171831050e4c6cec058d1781dec06b08ccb3 Mon Sep 17 00:00:00 2001
From: "unicoderbot[bot]" <269805761+unicoderbot[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 14:19:01 +0000
Subject: [PATCH 3/4] fix: address review feedback on PR #541

Co-authored-by: erickzanardo <erickzanardo@users.noreply.github.com>
---
 site/docs/workflows/dart_pub_publish.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/site/docs/workflows/dart_pub_publish.md b/site/docs/workflows/dart_pub_publish.md
index 798601e..05525ce 100644
--- a/site/docs/workflows/dart_pub_publish.md
+++ b/site/docs/workflows/dart_pub_publish.md
@@ -17,6 +17,13 @@ The Dart Pub Publish workflow consists of the following steps:
 
 This workflow uses the automated publishing of packages to pub.dev which is part of the [Dart documentation](https://dart.dev/tools/pub/automated-publishing). Before using this workflow ensure that you have configured your package on pub.dev correctly to allow the publish process to complete.
 
+Because this is a reusable workflow, it cannot grant itself the permissions required for OIDC publishing. The calling job must grant `id-token: write` so that `dart-lang/setup-dart` can request the OIDC token used to authenticate with pub.dev:
+
+```yaml
+permissions:
+  id-token: write
+```
+
 ## Inputs
 
 ### `dart_sdk`
@@ -58,6 +65,8 @@ on: pull_request
 
 jobs:
   build:
+    permissions:
+      id-token: write
     uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/dart_pub_publish.yml@v2
     with:
       dart_sdk: 'stable'

From 8436e76f92b54aae9076ab32552e0e6353c15290 Mon Sep 17 00:00:00 2001
From: "unicoderbot[bot]" <269805761+unicoderbot[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 14:41:43 +0000
Subject: [PATCH 4/4] fix: address review feedback on PR #541

Co-authored-by: erickzanardo <erickzanardo@users.noreply.github.com>
---
 site/docs/workflows/dart_pub_publish.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/site/docs/workflows/dart_pub_publish.md b/site/docs/workflows/dart_pub_publish.md
index 05525ce..64ae9c5 100644
--- a/site/docs/workflows/dart_pub_publish.md
+++ b/site/docs/workflows/dart_pub_publish.md
@@ -61,10 +61,13 @@ permissions:
 ```yaml
 name: My Dart Pub Publish Workflow
 
-on: pull_request
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
 
 jobs:
-  build:
+  publish:
     permissions:
       id-token: write
     uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/dart_pub_publish.yml@v2