Publishing to pub.dev With Zero Stored Secrets: OIDC and Per-Package Tags for a Federated Flutter Plugin
Every CI publishing pipeline I have ever set up began the same way: generate a long-lived token on the registry website, paste it into the repo's secret store, and promise myself I'd rotate it someday. (Narrator: he did not rotate it.) I've paid for that pattern before. On an earlier npm project, my tag-driven publish…