From 8b1317690e6ab8eaa67078db5c47ecfaff46c37f Mon Sep 17 00:00:00 2001
From: Erick Zanardo <erickzanardoo@gmail.com>
Date: Wed, 28 Oct 2026 11:54:36 -0300
Subject: [PATCH] fix(pub_publish): avoid secrets context in step conditions

GitHub does not expose the `secrets` context to step-level `if:`
conditions, so dart_pub_publish.yml and flutter_pub_publish.yml failed
workflow validation on every push. Map `pub_credentials` to a job-level
`PUB_CREDENTIALS` env var and check that instead. The credentials are
also now written via the env var rather than interpolated into the
script.

Adds a structural test that rejects `secrets.` in step conditions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/dart_pub_publish.yml    |  7 +++++--
 .github/workflows/flutter_pub_publish.yml |  9 ++++++---
 test/workflows.test.js                    | 11 +++++++++++
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dart_pub_publish.yml b/.github/workflows/dart_pub_publish.yml
index 3830f99..b2995be 100644
--- a/.github/workflows/dart_pub_publish.yml
+++ b/.github/workflows/dart_pub_publish.yml
@@ -32,6 +32,9 @@ on:
 
 jobs:
   publish:
+    env:
+      PUB_CREDENTIALS: ${{secrets.pub_credentials}}
+
     environment: ${{inputs.environment}}
 
     defaults:
@@ -55,10 +58,10 @@ jobs:
         run: dart pub get
 
       - name: 🔐 Setup Pub Credentials
-        if: ${{ secrets.pub_credentials != '' }}
+        if: ${{ env.PUB_CREDENTIALS != '' }}
         run: |
           mkdir -p $XDG_CONFIG_HOME/dart
-          echo '${{secrets.pub_credentials}}' > "$XDG_CONFIG_HOME/dart/pub-credentials.json"
+          echo "$PUB_CREDENTIALS" > "$XDG_CONFIG_HOME/dart/pub-credentials.json"
 
       - name: 🌵 Dry Run
         run: dart pub publish --dry-run
diff --git a/.github/workflows/flutter_pub_publish.yml b/.github/workflows/flutter_pub_publish.yml
index e15b0a2..d0cf857 100644
--- a/.github/workflows/flutter_pub_publish.yml
+++ b/.github/workflows/flutter_pub_publish.yml
@@ -40,6 +40,9 @@ on:
 
 jobs:
   publish:
+    env:
+      PUB_CREDENTIALS: ${{secrets.pub_credentials}}
+
     defaults:
       run:
         working-directory: ${{inputs.working_directory}}
@@ -64,13 +67,13 @@ jobs:
         run: flutter pub get
 
       - name: 🔐 Setup Pub Credentials
-        if: ${{ secrets.pub_credentials != '' }}
+        if: ${{ env.PUB_CREDENTIALS != '' }}
         run: |
           mkdir -p $XDG_CONFIG_HOME/dart
-          echo '${{secrets.pub_credentials}}' > "$XDG_CONFIG_HOME/dart/pub-credentials.json"
+          echo "$PUB_CREDENTIALS" > "$XDG_CONFIG_HOME/dart/pub-credentials.json"
 
       - name: 🎯 Setup Dart
-        if: ${{ secrets.pub_credentials == '' }}
+        if: ${{ env.PUB_CREDENTIALS == '' }}
         uses: dart-lang/setup-dart@v1.8.1
         with:
           sdk: ${{inputs.dart_sdk}}
diff --git a/test/workflows.test.js b/test/workflows.test.js
index 346edd1..1e4c424 100644
--- a/test/workflows.test.js
+++ b/test/workflows.test.js
@@ -295,6 +295,17 @@ describe('workflow templates', () => {
       expect(badSecrets).toEqual([]);
     });
 
+    test('no step condition references the secrets context', () => {
+      // GitHub does not expose `secrets` to `jobs.<id>.steps[*].if`, so such a
+      // workflow fails validation. Map the secret to `env` and check that instead.
+      const offending = Object.entries(doc.jobs || {}).flatMap(([jobId, job]) =>
+        ((job && job.steps) || [])
+          .filter((step) => step && /\bsecrets\./.test(String(step.if ?? '')))
+          .map((step) => `${jobId}: ${step.name}`),
+      );
+      expect(offending).toEqual([]);
+    });
+
     test('is documented on the docs site', () => {
       expect(fs.existsSync(path.join(docsDir, `${base}.md`))).toBe(true);
     });