[alonsopf89]

Summary

Updates .github/workflows/publish.yaml to stage tagged google_cloud* pub.dev package releases to Google's OSS Exit Gate generic Artifact Registry (us-generic.pkg.dev/oss-exit-gate-prod/google-cloud-dart--pubdev) and upload the release manifest to gs://oss-exit-gate-prod-projects-bucket/google-cloud-dart/pubdev/manifests/.

Key Details

• Provisioned Trusted Publisher service account in oss-exit-gate-prod: google-cloud-dart-pbd@oss-exit-gate-prod.iam.gserviceaccount.com.
• All GitHub Actions are pinned to 40-character commit SHAs and permissions (contents: read, id-token: write) are scoped to the job.
• Production onboarding CL (cl/1005949751) and end-to-end Artifact Registry + GCS smoke test for google-cloud-dart/pubdev have been verified in oss-exit-gate-prod.

Refs: b/576681668

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[brianquinlan]

Could you explain in more detail what this does?

[alonsopf89]

Hi @brianquinlan — happy to explain in detail!

Background (go/oss-exit-gate / b/576681668)

Google's Open Source Security team is migrating Google-owned open-source package releases across public registries (pub.dev, npm, PyPI, Maven Central, NuGet, Crates.io, RubyGems, BCR) to OSS Exit Gate (go/oss-exit-gate). Instead of GitHub Actions publishing directly to pub.dev, OSS Exit Gate acts as an internal release proxy and policy enforcement gate in GCP (oss-exit-gate-prod), governed by the internal project config at //depot/google3/configs/security/opensource/exit_gate/prod/projects/google-cloud-dart/pubdev/project.txtpb (cl/1005949751).

What this workflow change does step-by-step

When a release tag matching [A-z]+-v[0-9]+.[0-9]+.[0-9]+* (e.g. google_cloud_rpc-v0.1.0) is pushed to googleapis/google-cloud-dart, the stage-exit-gate job:

1. Authenticates keylessly via Workload Identity Federation (google-github-actions/auth):
   • Uses GitHub's OIDC token to authenticate against the Exit Gate WIF pool (projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github).
   • Only workflows explicitly allowlisted as builders in google-cloud-dart/pubdev/project.txtpb (github_workflow:googleapis/google-cloud-dart/.github/workflows/publish.yaml@refs/tags/*) are permitted to stage artifacts and trigger a release. No secrets or tokens are stored in GitHub.
2. Packages the tagged Dart package directory:
   • Parses PKG_NAME (${TAG_NAME%-v*}) and VERSION (${TAG_NAME##*-v}) from github.ref_name.
   • Resolves the package directory under pkgs/${PKG_NAME} or generated/${PKG_NAME} and creates ${PKG_NAME}-${VERSION}.tar.gz.
3. Stages the archive in Artifact Registry (gcloud artifacts generic upload):
   • Uploads ${PKG_NAME}-${VERSION}.tar.gz to the dedicated staging repository us-generic.pkg.dev/oss-exit-gate-prod/google-cloud-dart--pubdev.
4. Triggers OSS Exit Gate publication via GCS Manifest (gcloud storage cp):
   • Writes a targeted manifest.json specifying { "name": "${PKG_NAME}", "version": "${VERSION}" } and uploads it to gs://oss-exit-gate-prod-projects-bucket/google-cloud-dart/pubdev/manifests/.
   • Uploading this manifest triggers the internal OSS Exit Gate pubdev pipeline (security/opensource/exit_gate_v1/pipelines/pubdev/publish.sh), which verifies the package against the allowlist in project.txtpb, retrieves the staged .tar.gz from Artifact Registry, and publishes it to pub.dev using the Exit Gate Trusted Publisher service account (google-cloud-dart-pbd@oss-exit-gate-prod.iam.gserviceaccount.com).

Note on the existing publish (firehose) job

• Right now, the existing publish job (uses: dart-lang/ecosystem/.github/workflows/publish.yaml) is triggered on both pull_request (for firehose PR validation) and push: tags.
• If you'd like firehose to continue running on pull_request for validation while stage-exit-gate handles publishing on push: tags (once google-cloud-dart-pbd@oss-exit-gate-prod.iam.gserviceaccount.com is added as an automated publisher for the packages on pub.dev), we can also update the if: condition on publish to:

  if: ${{ github.repository_owner == 'googleapis' && github.event_name == 'pull_request' }}

  Please let me know if you'd like me to include that if: condition adjustment in this PR or if you have any questions!

[brianquinlan]

@alonsopf89 if you are a Google employee, contractor or vendor could you ping me internally at bquinlan@

[alonsopf89]

Thanks @brianquinlan! I will reach out to you internally at bquinlan@ (fernandoalonso@google.com) with the internal context and links.