Publish from a tag instead of from a laptop

[sovanken]

Summary

Releasing today means running flutter pub publish --force on the maintainer's machine against a long-lived refresh token in %APPDATA%/dart/pub-credentials.json. That token is the only thing between a laptop and the package's users, the release isn't reproducible, and there's no record of what was verified before it shipped.

This makes the tag the trigger.

The flow

git tag -a v1.3.0 -m "..." && git push origin v1.3.0
                    |
            [release.yml]
   1. tag == pubspec.yaml version?          -> else fail
   2. CHANGELOG has a [1.3.0] section?      -> else fail
   3. format / analyze / test / dry-run / pana
   4. publish via OIDC (no stored credential)
   5. GitHub Release from the changelog section

Step 1 exists because a mismatched tag would publish the wrong version under the right name, which pub.dev cannot undo. Step 2 exists because v1.1.0 sat tagged-but-unreleased for twelve days when that step was manual.

ci.yml also gains a Package & pub.dev score job, so packaging and score problems surface on the PR instead of at tag time when the version is already public.

Why assert_pana_score.py rather than --exit-code-threshold 0

I tried to validate the gate locally first. pana aborted — its sandbox runner rejects Windows drive-letter paths, and webpinfo was missing — and still exited 0. A gate that passes when the analysis crashed is worse than no gate, and would have looked identical to a working one.

So the score is asserted from pana's JSON instead: a missing score is a failure, and the section that lost points is named in the log. Both workflows install the webp tools first, since pana needs them to process the three screenshots pubspec.yaml declares — without them it logs SEVERE and can lose points pub.dev itself would grant.

The gate is set at full marks because the package currently scores 160/160.

Verified

Check	Result
Tag guard	v1.2.0 accepted, v9.9.9 rejected
Changelog extractor	returns the 1.2.0 section; exits non-zero for a missing version
Score asserter	passes at 160/160; fails at 150/160 naming the section; fails on a crashed run reporting no score
pub publish --dry-run	passes
pana itself	verified by this PR's CI — Windows cannot run it

That last row is the point of opening this as a PR: the new package job runs pana in the environment that actually matters, so if 160/160 doesn't hold on Ubuntu, this PR goes red before it merges rather than breaking your next release.

One-time setup needed before the next release

pub.dev → Admin → Automated publishing → repository sovanken/solar_iconkit, tag pattern v{{version}}. Until that's set the publish step will fail; every verification step before it works regardless. If you also enable "Require GitHub Actions environment" there, add environment: pub.dev to the job to match.

Type of change

• Chore (tooling, CI)

No packaged code changes.

🤖 Generated with Claude Code