ci: split out publishing workflow

Author: fadi-george

.github/workflows/cd.yml

@@ -1,4 +1,6 @@
-name: Publish to Pub.dev & Github
+# For Flutter publish, a tag must be created first so we create a Github Release
+# Then this should trigger the publish to Pub.dev workflow
+name: Publish to Github
 on:
   workflow_dispatch:
   pull_request:
@@ -8,10 +10,6 @@ on:
       - main
       - rel/**
 
-permissions:
-  id-token: write # Required for authentication using OIDC
-  contents: write
-
 jobs:
   publish:
     if: |
@@ -25,24 +23,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
 
-      - name: Set up Flutter
-        uses: ./.github/actions/setup-flutter
-
-      # This step is what enables Dart's OIDC "trusted publishing" wiring.
-      # Even though you publish with flutter, OIDC creds are handled via Dart tooling.
-      - uses: dart-lang/setup-dart@v1
-
       - name: Get version from pubspec.yaml
         id: version
         run: |
           VERSION=$(grep "^version:" pubspec.yaml | sed 's/version: //' | tr -d ' ')
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "Version: $VERSION"
 
-      - name: Publish to Pub.dev
-        run: |
-          flutter pub publish --force
-
   create-release:
     needs: publish
     uses: OneSignal/sdk-actions/.github/workflows/github-release.yml@main

.github/workflows/publish.yml

@@ -0,0 +1,17 @@
+# OIDC published for pub.dev
+# Reference: https://dart.dev/tools/pub/automated-publishing
+name: Publish to pub.dev
+
+on:
+  push:
+    tags:
+      # must align with the tag-pattern configured on pub.dev, often just replace
+      # {{version}} with [0-9]+.[0-9]+.[0-9]+
+      - "[0-9]+.[0-9]+.[0-9]+" # tag-pattern on pub.dev: '{{version}}'
+
+# Publish using the reusable workflow from dart-lang.
+jobs:
+  publish:
+    permissions:
+      id-token: write # Required for authentication using OIDC
+    uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1