Pub from GitLab CI/CD

GitLab CI/CD jobs read and publish your private packages with no stored secret: each job exchanges its own identity token for a Pub token that lasts 15 minutes. How it works on every provider is on Pub from CI.

1. Trust the issuer

GitLab.com is trusted already. For a self-managed GitLab, an Owner adds its address, https://<your host>, as this organization's own issuer.

2. Bind the repository

In the Control Room, open Organization, then CI access, Bind a repository, and choose GitLab CI/CD. The form asks for:

Project path: the project's full path, nested groups included: acme/mobile/app.
Namespace path, optional: the group the project is in: acme/mobile. Left out, it is read from the project path.
Pipeline configuration file, optional: the configuration allowed to publish: .gitlab-ci.yml.
Environment name, optional: a job's environment:, such as production. Protected environments then gate every exchange.
Ref pattern, optional: a branch or a tag: refs/tags/v* or refs/heads/main.

Then grant the binding its packages with its Packages button: read, or read and publish.

[TODO: screenshot of the Bind a repository dialog with GitLab CI/CD chosen and acme/mobile/app filled in]

3. Exchange in the job

Put your organization id, from the same Organization screen, in DARTASTIC_ORG_ID. This job publishes; for one that only reads, drop dart pub publish and grant the binding read only.

yaml

# .gitlab-ci.yml: publish on a version tag
publish:
  image: dart:stable
  rules:
    - if: $CI_COMMIT_TAG =~ /^v/
  environment: production   # optional: bind the environment too
  id_tokens:
    DARTASTIC_ID_TOKEN:
      aud: https://dartastic.io
  variables:
    DARTASTIC_ORG_ID: "<your organization id>"
  script:
    - apt-get update -qq && apt-get install -y -qq jq
    - |
      RESP=$(curl -sS --fail-with-body -X POST https://api.dartastic.io/v1/ci/exchange \
        -H "Authorization: Bearer $DARTASTIC_ID_TOKEN" -H "Content-Type: application/json" \
        -d "{\"orgId\":\"$DARTASTIC_ORG_ID\"}") || { echo "$RESP" >&2; exit 1; }
      export PUB_TOKEN=$(echo "$RESP" | jq -er .token)
      dart pub token add https://pub.dartastic.io --env-var PUB_TOKEN
    - dart pub get
    - dart pub publish --force

id_tokens: gives the job its token in the variable you name, here DARTASTIC_ID_TOKEN, with aud: https://dartastic.io.
Mark the publishing tags or branches as protected in GitLab, so only maintainers can start a run that exchanges.

[TODO: screenshot of a GitLab pipeline job whose exchange succeeded, then dart pub publish]

When it is refused

The job's log shows the reason first, such as TRUSTED PUBLISHER REF MISMATCH. Every reason and what to do is on Pub from CI. GitLab CI/CD's own guide to its tokens is in its documentation.