fix: avoid secrets context in pub publish step conditions

.github/workflows/dart_pub_publish.yml

@@ -32,6 +32,9 @@ on:
 
 jobs:
   publish:
+    env:
+      PUB_CREDENTIALS: ${{secrets.pub_credentials}}
+
     environment: ${{inputs.environment}}
 
     defaults:
@@ -55,10 +58,10 @@ jobs:
         run: dart pub get
 
       - name: 🔐 Setup Pub Credentials
-        if: ${{ secrets.pub_credentials != '' }}
+        if: ${{ env.PUB_CREDENTIALS != '' }}
         run: |
           mkdir -p $XDG_CONFIG_HOME/dart
-          echo '${{secrets.pub_credentials}}' > "$XDG_CONFIG_HOME/dart/pub-credentials.json"
+          echo "$PUB_CREDENTIALS" > "$XDG_CONFIG_HOME/dart/pub-credentials.json"
 
       - name: 🌵 Dry Run
         run: dart pub publish --dry-run

.github/workflows/flutter_pub_publish.yml

@@ -40,6 +40,9 @@ on:
 
 jobs:
   publish:
+    env:
+      PUB_CREDENTIALS: ${{secrets.pub_credentials}}
+
     defaults:
       run:
         working-directory: ${{inputs.working_directory}}
@@ -64,13 +67,13 @@ jobs:
         run: flutter pub get
 
       - name: 🔐 Setup Pub Credentials
-        if: ${{ secrets.pub_credentials != '' }}
+        if: ${{ env.PUB_CREDENTIALS != '' }}
         run: |
           mkdir -p $XDG_CONFIG_HOME/dart
-          echo '${{secrets.pub_credentials}}' > "$XDG_CONFIG_HOME/dart/pub-credentials.json"
+          echo "$PUB_CREDENTIALS" > "$XDG_CONFIG_HOME/dart/pub-credentials.json"
 
       - name: 🎯 Setup Dart
-        if: ${{ secrets.pub_credentials == '' }}
+        if: ${{ env.PUB_CREDENTIALS == '' }}
         uses: dart-lang/setup-dart@v1.8.1
         with:
           sdk: ${{inputs.dart_sdk}}

test/workflows.test.js

@@ -295,6 +295,17 @@ describe('workflow templates', () => {
       expect(badSecrets).toEqual([]);
     });
 
+    test('no step condition references the secrets context', () => {
+      // GitHub does not expose `secrets` to `jobs.<id>.steps[*].if`, so such a
+      // workflow fails validation. Map the secret to `env` and check that instead.
+      const offending = Object.entries(doc.jobs || {}).flatMap(([jobId, job]) =>
+        ((job && job.steps) || [])
+          .filter((step) => step && /\bsecrets\./.test(String(step.if ?? '')))
+          .map((step) => `${jobId}: ${step.name}`),
+      );
+      expect(offending).toEqual([]);
+    });
+
     test('is documented on the docs site', () => {
       expect(fs.existsSync(path.join(docsDir, `${base}.md`))).toBe(true);
     });