feat(ci): Add workflow for package score (#6755)

Author: Jonas Greifenhain

.github/composite_actions/package_score/action.yaml

@@ -0,0 +1,83 @@
+name: Package Score
+description: |
+  Run pana (pub.dev package analyzer) to compute the package score,
+  print a readable report to the workflow log, and upload the raw
+  markdown report as a workflow artifact (score_report.md).
+  The score is compared against the currently published version on
+  pub.dev — the build fails if the score regresses. If the package
+  has never been published, no threshold is enforced.
+
+inputs:
+  working-directory:
+    description: The working directory of the package (relative to repo root)
+    required: true
+  package-name:
+    description: The name of the package being scored
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install pana
+      shell: bash
+      run: dart pub global activate pana
+
+    - name: Fetch published score from pub.dev
+      id: published
+      shell: bash
+      run: |
+        PACKAGE_NAME="${{ inputs.package-name }}"
+        HTTP_CODE=$(curl -s -o "$RUNNER_TEMP/pubdev_score.json" -w "%{http_code}" \
+          "https://pub.dev/api/packages/${PACKAGE_NAME}/score")
+
+        if [ "$HTTP_CODE" = "200" ]; then
+          GRANTED=$(python3 -c "import json; d=json.load(open('$RUNNER_TEMP/pubdev_score.json')); print(d.get('grantedPoints', 0))")
+          MAX=$(python3 -c "import json; d=json.load(open('$RUNNER_TEMP/pubdev_score.json')); print(d.get('maxPoints', 160))")
+          THRESHOLD=$((MAX - GRANTED))
+          echo "published=true" >> "$GITHUB_OUTPUT"
+          echo "granted=$GRANTED" >> "$GITHUB_OUTPUT"
+          echo "max=$MAX" >> "$GITHUB_OUTPUT"
+          echo "threshold=$THRESHOLD" >> "$GITHUB_OUTPUT"
+          echo "Published score for ${PACKAGE_NAME}: ${GRANTED}/${MAX} (threshold: ${THRESHOLD})"
+        else
+          echo "published=false" >> "$GITHUB_OUTPUT"
+          echo "Package ${PACKAGE_NAME} not found on pub.dev (HTTP ${HTTP_CODE}) — skipping threshold enforcement"
+        fi
+
+    - name: Run pana
+      id: pana
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: |
+        set +e
+        if [ "${{ steps.published.outputs.published }}" = "true" ]; then
+          echo "Enforcing threshold: score must be at least ${{ steps.published.outputs.granted }}/${{ steps.published.outputs.max }} (published score)"
+          dart pub global run pana \
+            --exit-code-threshold ${{ steps.published.outputs.threshold }} \
+            --no-warning . > "$RUNNER_TEMP/score_report.md" 2>&1
+        else
+          echo "No published score found — running pana without threshold"
+          dart pub global run pana \
+            --no-warning . > "$RUNNER_TEMP/score_report.md" 2>&1
+        fi
+        PANA_EXIT=$?
+        set -e
+        echo "pana_exit=$PANA_EXIT" >> "$GITHUB_OUTPUT"
+
+    - name: Print score report
+      shell: bash
+      run: python3 "$GITHUB_ACTION_PATH/render_score.py" "$RUNNER_TEMP/score_report.md"
+
+    - name: Upload score report
+      if: always()
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
+      with:
+        name: score_report-${{ inputs.package-name }}-${{ github.run_id }}
+        path: ${{ runner.temp }}/score_report.md
+
+    - name: Enforce score threshold
+      if: steps.pana.outputs.pana_exit != '0'
+      shell: bash
+      run: |
+        echo "::error::Pana score regressed below the published score (${{ steps.published.outputs.granted }}/${{ steps.published.outputs.max }}) on pub.dev"
+        exit ${{ steps.pana.outputs.pana_exit }}

.github/composite_actions/package_score/render_score.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""Render pana score markdown as a readable ASCII terminal report."""
+import re
+import sys
+
+
+def render(text):
+    W = 72
+    lines = []
+
+    def bar(label, got, total):
+        pct = got / total if total else 0
+        filled = int(pct * 20)
+        return f"  {label:<45} [{'█' * filled + '░' * (20 - filled)}] {got}/{total}"
+
+    lines.append("=" * W)
+    lines.append("  PACKAGE SCORE REPORT".center(W))
+    lines.append("=" * W)
+
+    m = re.search(r'Points:\s*(\d+)\s*/\s*(\d+)', text)
+    if m:
+        got, total = int(m.group(1)), int(m.group(2))
+        lines.append(f"\n  Total: {got} / {total} points")
+        lines.append(bar("Overall", got, total))
+        lines.append("")
+
+    for sm in re.finditer(r'^## (✓|✗)\s+(.+?)\s*\((\d+)\s*/\s*(\d+)\)', text, re.M):
+        icon = "✓" if sm.group(1) == "✓" else "✗"
+        name, got, total = sm.group(2), int(sm.group(3)), int(sm.group(4))
+        lines.append("-" * W)
+        lines.append(f"  {icon}  {name}")
+        lines.append(bar(name, got, total))
+
+        sec_start = sm.end()
+        sec_end = text.find("\n## ", sec_start)
+        if sec_end == -1:
+            sec_end = len(text)
+        section = text[sec_start:sec_end]
+
+        for sub in re.finditer(r'^### \[(.)\]\s+(\d+)/(\d+) points:\s+(.+)', section, re.M):
+            mark = sub.group(1)
+            sg, st, label = int(sub.group(2)), int(sub.group(3)), re.sub(r'\*\*([^*]+)\*\*', r'\1', sub.group(4))
+            sym = {"*": "✓", "x": "✗", "~": "~"}.get(mark, mark)
+            lines.append(f"    {sym} {sg:>2}/{st:<2}  {label}")
+
+        if "platform" in name.lower():
+            if re.search(r'\*\*WASM-ready:\*\*', section):
+                lines.append("    ✓  WASM compatible")
+            elif re.search(r'not WASM-compatible', section):
+                lines.append("    ✗  WASM not compatible (partial Web score)")
+
+    lines.append("-" * W)
+
+    issues = re.findall(
+        r'The constraint `([^`]+)` on (\w+) does not support the stable version `([^`]+)`', text
+    )
+    if issues:
+        lines.append(f"\n  ⚠  Dependency issues ({len(issues)}):")
+        for constraint, pkg, ver in issues:
+            lines.append(f"    • {pkg}: {constraint} doesn't support {ver}")
+
+    lines.append("")
+    print("\n".join(lines))
+
+
+if __name__ == "__main__":
+    path = sys.argv[1] if len(sys.argv) > 1 else "score.md"
+    render(open(path).read())

.github/workflows/dart_vm.yaml

@@ -106,6 +106,13 @@ jobs:
         run: dart analyze --fatal-infos --fatal-warnings .
         working-directory: ${{ inputs.working-directory }}
 
+      - name: Package Score
+        if: "always() && steps.bootstrap.conclusion == 'success' && matrix.sdk == 'stable'"
+        uses: ./.github/composite_actions/package_score
+        with:
+          working-directory: ${{ inputs.working-directory }}
+          package-name: ${{ inputs.package-name }}
+
       - name: Run Tests (stable)
         if: "always() && steps.bootstrap.conclusion == 'success' && steps.testCheck.outputs.hasTests == 'true' && matrix.sdk == 'stable'"
         run: dart test

.github/workflows/flutter_vm.yaml

@@ -88,6 +88,13 @@ jobs:
         run: flutter analyze --fatal-infos --fatal-warnings .
         working-directory: ${{ inputs.working-directory }}
 
+      - name: Package Score
+        if: "always() && steps.bootstrap.conclusion == 'success' && matrix.channel == 'stable' && matrix.flutter-version == 'any'"
+        uses: ./.github/composite_actions/package_score
+        with:
+          working-directory: ${{ inputs.working-directory }}
+          package-name: ${{ inputs.package-name }}
+
       - name: Run Tests
         id: testJob
         if: "always() && steps.bootstrap.conclusion == 'success' && steps.testCheck.outputs.hasTests == 'true'"