Fix publish workflow failing on the flutter_webrtc pin warning (#1140)

Every publish workflow run in this repo's history has failed with exit
code 65. The dart-lang reusable publish workflow runs a non-interactive
`dart pub publish`, which treats any validation warning as fatal. Our
exact `flutter_webrtc` pin is intentional (the native WebRTC-SDK pods
must match between the two packages) but always produces the 'should
allow more than one version' warning, so the workflow can never succeed
and every release so far has been published manually.

This replaces the reusable workflow with an inline job that publishes
with `--force`, which downgrades warnings to informational.
`dart-lang/setup-dart` is kept solely for pub.dev auth: with `id-token:
write` it mints a temporary pub.dev token from the GitHub OIDC token and
registers it in the shared pub config, which the Flutter-side `dart pub
publish` then picks up. The pub.dev trust configuration is based on
repository and tag claims, not the workflow definition, so no changes
are needed on the pub.dev side.

Author: hiroshihorie

.github/workflows/publish.yaml

@@ -21,8 +21,52 @@ on:
 
 jobs:
   publish:
+    runs-on: ubuntu-latest
     permissions:
+      contents: read # Checkout needs this back once any permission is declared
       id-token: write # Required for authentication using OIDC
-    uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1
-    # with:
-    #   working-directory: path/to/package/within/repository
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Check tag matches pubspec version
+        run: |
+          version=$(sed -n 's/^version: *//p' pubspec.yaml)
+          if [ "v$version" != "$GITHUB_REF_NAME" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match pubspec version $version"
+            exit 1
+          fi
+
+      # Mints a temporary pub.dev token from the GitHub OIDC token and
+      # registers it in the shared pub config used by the publish step.
+      - name: Setup Dart for pub.dev auth
+        uses: dart-lang/setup-dart@v1
+
+      - name: Setup Flutter
+        uses: ./.github/actions/setup-flutter
+
+      # The exact flutter_webrtc pin is intentional (native WebRTC-SDK pods
+      # must match) but always triggers a pub validation warning, and pub
+      # treats any warning as fatal without --force. Publishing needs --force
+      # because of that, so this step makes sure the pin warning is the only
+      # validation issue before the forced publish runs.
+      - name: Validate package, only the flutter_webrtc pin warning is allowed
+        run: |
+          set +e
+          output=$(dart pub publish --dry-run 2>&1)
+          status=$?
+          set -e
+          echo "$output"
+          if [ "$status" -eq 0 ]; then
+            exit 0
+          fi
+          unexpected=$(echo "$output" | grep '^\* ' | grep -v 'dependency on "flutter_webrtc" should allow more than one version' || true)
+          if echo "$output" | grep -q '^Package has 1 warning\.$' && [ -z "$unexpected" ]; then
+            echo "Only the expected flutter_webrtc pin warning was found, continuing."
+            exit 0
+          fi
+          echo "Validation found issues other than the expected flutter_webrtc pin warning, refusing to publish."
+          exit 1
+
+      - name: Publish
+        run: dart pub publish --force

AGENTS.md

@@ -60,4 +60,4 @@ Most regressions live in `lib/src/core/` (`room.dart`, `engine.dart`, `signal_cl
 
 ## Releases
 
-Every PR needs a changeset file in `.changes/` (format: `patch|minor|major type="fixed|added|changed|..." "description"`); CI checks for it and runs `dart-apitool` against `main` to require a `major` changeset for breaking public-API changes. Releases are tag-driven (`vX.Y.Z`) and publish to pub.dev.
+Every PR that affects the published package needs a changeset file in `.changes/` (format: `patch|minor|major type="fixed|added|changed|..." "description"`); CI checks for it and runs `dart-apitool` against `main` to require a `major` changeset for breaking public-API changes. PRs that only touch CI workflows or repo tooling are exempt, a changeset would put noise in the user facing changelog. Releases are tag-driven (`vX.Y.Z`) and publish to pub.dev.