feat(shorebird_ci): tag-based pub.dev publishing + CI matrix (#3727)

.github/workflows/main.yaml

@@ -102,6 +102,11 @@ jobs:
               - ./.github/workflows/main.yaml
               - ./.github/actions/dart_package/action.yaml
               - packages/scoped_deps/**
+            shorebird_ci:
+              - ./.github/codecov.yml
+              - ./.github/workflows/main.yaml
+              - ./.github/actions/dart_package/action.yaml
+              - packages/shorebird_ci/**
             stripe_api:
               - ./.github/codecov.yml
               - ./.github/workflows/main.yaml

.github/workflows/publish_dart_package.yaml

@@ -0,0 +1,67 @@
+# cspell:words pipefail
+name: Publish Dart Package
+
+on:
+  workflow_call:
+    inputs:
+      working_directory:
+        required: true
+        type: string
+        description: Path to the package directory (e.g., packages/shorebird_ci).
+      tag_prefix:
+        required: true
+        type: string
+        description: |
+          Tag prefix expected for this package (e.g., "shorebird_ci-v"). The
+          version after the prefix must match the version in pubspec.yaml.
+
+jobs:
+  publish:
+    name: 📦 Publish ${{ inputs.working_directory }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+
+    steps:
+      - name: 📚 Git Checkout
+        uses: actions/checkout@v6
+
+      - name: 🎯 Setup Dart
+        uses: dart-lang/setup-dart@v1
+        with:
+          sdk: stable
+
+      - name: 🔎 Verify tag matches pubspec version
+        working-directory: ${{ inputs.working_directory }}
+        run: |
+          set -euo pipefail
+          PUBSPEC_VERSION=$(awk '/^version:/ {print $2}' pubspec.yaml)
+          TAG_VERSION="${GITHUB_REF_NAME#${{ inputs.tag_prefix }}}"
+          echo "Tag version:     $TAG_VERSION"
+          echo "Pubspec version: $PUBSPEC_VERSION"
+          [ -n "$PUBSPEC_VERSION" ] || { echo "::error::no version found in pubspec.yaml"; exit 1; }
+          [ -n "$TAG_VERSION" ] || { echo "::error::tag $GITHUB_REF_NAME has no version after prefix ${{ inputs.tag_prefix }}"; exit 1; }
+          if [ "$PUBSPEC_VERSION" != "$TAG_VERSION" ]; then
+            echo "::error::Tag version ($TAG_VERSION) does not match pubspec version ($PUBSPEC_VERSION)"
+            exit 1
+          fi
+
+      - name: 📦 Install dependencies
+        working-directory: ${{ inputs.working_directory }}
+        run: dart pub get
+
+      - name: 🔍 Analyze
+        working-directory: ${{ inputs.working_directory }}
+        run: dart analyze --fatal-warnings lib test
+
+      - name: 🧪 Test
+        working-directory: ${{ inputs.working_directory }}
+        run: dart test
+
+      - name: 🚀 Publish (dry run)
+        working-directory: ${{ inputs.working_directory }}
+        run: dart pub publish --dry-run
+
+      - name: 🚀 Publish
+        working-directory: ${{ inputs.working_directory }}
+        run: dart pub publish --force

.github/workflows/publish_scoped_deps.yaml

@@ -0,0 +1,15 @@
+name: Publish scoped_deps
+
+on:
+  push:
+    tags:
+      - "scoped_deps-v[0-9]+.[0-9]+.[0-9]+*"
+
+jobs:
+  publish:
+    uses: ./.github/workflows/publish_dart_package.yaml
+    with:
+      working_directory: packages/scoped_deps
+      tag_prefix: scoped_deps-v
+    permissions:
+      id-token: write

.github/workflows/publish_shorebird_ci.yaml

@@ -0,0 +1,15 @@
+name: Publish shorebird_ci
+
+on:
+  push:
+    tags:
+      - "shorebird_ci-v[0-9]+.[0-9]+.[0-9]+*"
+
+jobs:
+  publish:
+    uses: ./.github/workflows/publish_dart_package.yaml
+    with:
+      working_directory: packages/shorebird_ci
+      tag_prefix: shorebird_ci-v
+    permissions:
+      id-token: write

.github/workflows/publish_shorebird_redis_client.yaml

@@ -0,0 +1,15 @@
+name: Publish shorebird_redis_client
+
+on:
+  push:
+    tags:
+      - "shorebird_redis_client-v[0-9]+.[0-9]+.[0-9]+*"
+
+jobs:
+  publish:
+    uses: ./.github/workflows/publish_dart_package.yaml
+    with:
+      working_directory: packages/redis_client
+      tag_prefix: shorebird_redis_client-v
+    permissions:
+      id-token: write

packages/shorebird_ci/CHANGELOG.md

@@ -0,0 +1,3 @@
+# 0.1.0
+
+- Initial release.

packages/shorebird_ci/lib/src/dependency_resolver.dart

@@ -41,8 +41,11 @@ class DependencyResolver {
       if (entry.value is YamlMap) {
         final pathValue = (entry.value as YamlMap)['path'];
         if (pathValue != null) {
-          final resolved = p.normalize(
-            p.join(packageDir, pathValue as String),
+          // Repo-relative paths flow into YAML and Linux runners, so
+          // resolve with the POSIX context to keep separators forward-
+          // slashed on Windows.
+          final resolved = p.posix.normalize(
+            p.posix.join(packageDir, pathValue as String),
           );
           deps.add(resolved);
         }

packages/shorebird_ci/lib/src/repository_analyzer.dart

@@ -162,8 +162,13 @@ class RepositoryAnalyzer {
 
   static bool _isUnderSubmodule(String path, Set<String> submodulePaths) {
     for (final submodule in submodulePaths) {
-      if (path == submodule) return true;
-      if (path.startsWith('$submodule${p.separator}')) return true;
+      // p.equals / p.isWithin handle mixed separators (the submodule
+      // path comes from git as POSIX, while the walked Directory.path
+      // is platform-native — naive string compare misses on Windows).
+      // p.isWithin is also non-trivial-prefix-aware: a submodule at
+      // `packages/foo` does not match `packages/foo_bar`.
+      if (p.equals(path, submodule)) return true;
+      if (p.isWithin(submodule, path)) return true;
     }
     return false;
   }

packages/shorebird_ci/pubspec.yaml

@@ -4,6 +4,9 @@ description: >-
   workflows, resolves affected packages via dependency graphs, and
   verifies path filters stay in sync.
 version: 0.1.0
+homepage: https://shorebird.dev
+repository: https://github.com/shorebirdtech/shorebird/tree/main/packages/shorebird_ci
+topics: [ci, github-actions, monorepo, shorebird]
 resolution: workspace
 
 environment: