.gitea/workflows/ci.yml

@@ -0,0 +1,184 @@
+name: CI and Release
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+jobs:
+  format:
+    name: format
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Dart
+        uses: dart-lang/setup-dart@v1
+      - name: Install dependencies
+        run: dart pub get
+      - name: Check formatting
+        run: dart format --output=none --set-exit-if-changed .
+
+  analyze:
+    name: analyze
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Dart
+        uses: dart-lang/setup-dart@v1
+      - name: Install dependencies
+        run: dart pub get
+      - name: Run analyzer
+        run: dart analyze --fatal-infos
+
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Dart
+        uses: dart-lang/setup-dart@v1
+      - name: Install dependencies
+        run: dart pub get
+      - name: Run tests
+        run: dart test
+
+  pana:
+    name: pana
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Dart
+        uses: dart-lang/setup-dart@v1
+      - name: Install dependencies
+        run: dart pub get
+      - name: Run pana and enforce full score
+        run: |
+          set -euo pipefail
+          dart pub global activate pana
+          export PATH="$PATH:$HOME/.pub-cache/bin"
+
+          pana . | tee /tmp/pana.log
+
+          SCORE_LINE="$(grep -Eo 'Points: [0-9]+/[0-9]+' /tmp/pana.log | tail -n1 || true)"
+          if [ -z "$SCORE_LINE" ]; then
+            echo "Could not parse pana score output."
+            exit 1
+          fi
+
+          SCORE="${SCORE_LINE#Points: }"
+          GOT="${SCORE%/*}"
+          MAX="${SCORE#*/}"
+
+          if [ "$GOT" -ne "$MAX" ]; then
+            echo "Pana score must be full. Got $SCORE."
+            exit 1
+          fi
+
+          echo "Pana full score confirmed: $SCORE"
+
+  version_and_changelog:
+    name: version-and-changelog
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Validate release metadata for PRs into main
+        run: |
+          set -euo pipefail
+
+          if [ "${GITHUB_EVENT_NAME}" != "pull_request" ]; then
+            echo "Not a pull_request event; skipping version/changelog gate."
+            exit 0
+          fi
+
+          if [ -z "${GITHUB_BASE_REF:-}" ]; then
+            echo "GITHUB_BASE_REF is not set for pull_request event."
+            exit 1
+          fi
+
+          git fetch origin "${GITHUB_BASE_REF}" --depth=1
+
+          PR_VERSION="$(sed -nE 's/^version:\s*([^[:space:]]+)\s*$/\1/p' pubspec.yaml | head -n1)"
+          BASE_VERSION="$(git show "origin/${GITHUB_BASE_REF}:pubspec.yaml" | sed -nE 's/^version:\s*([^[:space:]]+)\s*$/\1/p' | head -n1)"
+
+          if [ -z "$PR_VERSION" ] || [ -z "$BASE_VERSION" ]; then
+            echo "Unable to read versions from pubspec.yaml."
+            exit 1
+          fi
+
+          if [ "$PR_VERSION" = "$BASE_VERSION" ]; then
+            echo "pubspec.yaml version was not updated (still $PR_VERSION)."
+            exit 1
+          fi
+
+          if git diff --quiet "origin/${GITHUB_BASE_REF}...HEAD" -- CHANGELOG.md; then
+            echo "CHANGELOG.md must be updated in the PR."
+            exit 1
+          fi
+
+          if ! grep -Fq "## $PR_VERSION" CHANGELOG.md && ! grep -Fq "## [$PR_VERSION]" CHANGELOG.md; then
+            echo "CHANGELOG.md must include a heading for version $PR_VERSION."
+            exit 1
+          fi
+
+          echo "Version/changelog gate passed: $BASE_VERSION -> $PR_VERSION"
+
+  publish:
+    name: publish
+    runs-on: ubuntu-latest
+    needs:
+      - format
+      - analyze
+      - test
+      - pana
+      - version_and_changelog
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Dart
+        uses: dart-lang/setup-dart@v1
+      - name: Publish package on push to main
+        env:
+          PUB_CREDENTIALS_JSON: ${{ secrets.PUB_CREDENTIALS_JSON }}
+        run: |
+          set -euo pipefail
+
+          if [ "${GITHUB_EVENT_NAME}" != "push" ] || [ "${GITHUB_REF}" != "refs/heads/main" ]; then
+            echo "Not a push to main; skipping publish."
+            exit 0
+          fi
+
+          PACKAGE_NAME="$(sed -nE 's/^name:\s*([^[:space:]]+)\s*$/\1/p' pubspec.yaml | head -n1)"
+          PACKAGE_VERSION="$(sed -nE 's/^version:\s*([^[:space:]]+)\s*$/\1/p' pubspec.yaml | head -n1)"
+
+          if [ -z "$PACKAGE_NAME" ] || [ -z "$PACKAGE_VERSION" ]; then
+            echo "Failed to parse package name/version from pubspec.yaml."
+            exit 1
+          fi
+
+          if curl -fsSL "https://pub.dev/api/packages/${PACKAGE_NAME}" | grep -q "\"version\":\"${PACKAGE_VERSION}\""; then
+            echo "${PACKAGE_NAME} ${PACKAGE_VERSION} is already published; skipping."
+            exit 0
+          fi
+
+          if [ -z "${PUB_CREDENTIALS_JSON:-}" ]; then
+            echo "Missing required secret PUB_CREDENTIALS_JSON."
+            exit 1
+          fi
+
+          mkdir -p "$HOME/.pub-cache"
+          printf '%s' "$PUB_CREDENTIALS_JSON" > "$HOME/.pub-cache/credentials.json"
+          chmod 600 "$HOME/.pub-cache/credentials.json"
+
+          dart pub get
+          dart pub publish --dry-run
+          dart pub publish --force

.githooks/pre-commit

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+set -eu
+
+printf '%s\n' 'Running pre-commit checks: dart format + dart analyze'
+
+dart format --output=none --set-exit-if-changed .
+dart analyze --fatal-infos
+
+printf '%s\n' 'Pre-commit checks passed.'

.githooks/pre-push

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+set -eu
+
+printf '%s\n' 'Running pre-push checks: dart format + dart test'
+
+dart format --output=none --set-exit-if-changed .
+dart test
+
+printf '%s\n' 'Pre-push checks passed.'