如何通过GitHub Action部署Flutter包？解决Pub授权问题

我通过GitHub Action将包部署到pub.dev，完成所有配置流程后，仍然收到提示：

Pub needs your authorization to upload packages on your behalf.

以下是我的配置文件和日志：

秘钥配置脚本pub_login.sh #

# This script creates/updates pub-credentials.json file which is used
# to authorize publisher when publishing packages to pub.dev

# Checking whether the secrets are available as environment
# variables or not.
if [ -z "${PUB_DEV_PUBLISH_ACCESS_TOKEN}" ]; then
  echo "Missing PUB_DEV_PUBLISH_ACCESS_TOKEN environment variable"
  exit 1
fi

if [ -z "${PUB_DEV_PUBLISH_REFRESH_TOKEN}" ]; then
  echo "Missing PUB_DEV_PUBLISH_REFRESH_TOKEN environment variable"
  exit 1
fi

if [ -z "${PUB_DEV_PUBLISH_TOKEN_ENDPOINT}" ]; then
  echo "Missing PUB_DEV_PUBLISH_TOKEN_ENDPOINT environment variable"
  exit 1
fi

if [ -z "${PUB_DEV_PUBLISH_EXPIRATION}" ]; then
  echo "Missing PUB_DEV_PUBLISH_EXPIRATION environment variable"
  exit 1
fi
# ADD THIS LINE TO CREATE THE DIRECTORY
mkdir -p ~/.pub-cache
# Create pub-credentials.json file.
cat <<EOF > ~/.pub-cache/pub-credentials.json
{
  "accessToken":"${PUB_DEV_PUBLISH_ACCESS_TOKEN}",
  "refreshToken":"${PUB_DEV_PUBLISH_REFRESH_TOKEN}",
  "tokenEndpoint":"${PUB_DEV_PUBLISH_TOKEN_ENDPOINT}",
  "scopes":["https://www.googleapis.com/auth/userinfo.email","openid"],
  "expiration":${PUB_DEV_PUBLISH_EXPIRATION}
}
EOF

GitHub Action YAML配置 #

on:
  release:
    branches:
      - master
jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2
      - name: Install Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.3.3'
      - name: Install dependencies
        run: flutter pub get
      - name: Analyze
        run: flutter analyze
      - name: Run tests
        run: flutter test
      - name: Setup Pub Credentials
        shell: bash
        env:
          PUB_DEV_PUBLISH_ACCESS_TOKEN: ${{ secrets.PUB_DEV_PUBLISH_ACCESS_TOKEN }}
          PUB_DEV_PUBLISH_REFRESH_TOKEN: ${{ secrets.PUB_DEV_PUBLISH_REFRESH_TOKEN }}
          PUB_DEV_PUBLISH_TOKEN_ENDPOINT: ${{ secrets.PUB_DEV_PUBLISH_TOKEN_ENDPOINT }}
          PUB_DEV_PUBLISH_EXPIRATION: ${{ secrets.PUB_DEV_PUBLISH_EXPIRATION }}
        run: |
          sh ./pub_login.sh
      - name: Check Publish Warnings
        run: dart pub publish --dry-run
      - name: Publish Package
        run: dart pub publish -f

相关日志截图 #

解决方案 #

1. 确保凭证文件权限正确 #

脚本生成pub-credentials.json后，添加权限设置避免pub无法读取：
在脚本的cat <<EOF > ~/.pub-cache/pub-credentials.json代码块后新增：

chmod 600 ~/.pub-cache/pub-credentials.json

2. 显式指定PUB_CACHE路径 #

在执行pub命令的步骤前，明确设置缓存路径，确保pub能定位到凭证文件：
修改Action中的发布相关步骤：

- name: Check Publish Warnings
  run: |
    export PUB_CACHE="$HOME/.pub-cache"
    dart pub publish --dry-run
- name: Publish Package
  run: |
    export PUB_CACHE="$HOME/.pub-cache"
    dart pub publish -f

3. 验证凭证有效性 #

• 检查PUB_DEV_PUBLISH_EXPIRATION是否为数字时间戳（不能是字符串格式），确认未过期。
• 重新获取有效凭证：在本地执行dart pub publish完成授权后，从本地~/.pub-cache/pub-credentials.json中复制最新的凭证值到GitHub Secrets。

4. 统一Flutter/Dart环境版本 #

确保Action中安装的Flutter版本与本地测试版本一致，不同版本的pub对凭证路径的处理可能存在差异。

5. 直接在Action步骤中生成凭证文件 #

避免脚本路径问题，将凭证生成逻辑直接写入Action步骤：
替换原Setup Pub Credentials步骤为：

- name: Setup Pub Credentials
  shell: bash
  env:
    PUB_DEV_PUBLISH_ACCESS_TOKEN: ${{ secrets.PUB_DEV_PUBLISH_ACCESS_TOKEN }}
    PUB_DEV_PUBLISH_REFRESH_TOKEN: ${{ secrets.PUB_DEV_PUBLISH_REFRESH_TOKEN }}
    PUB_DEV_PUBLISH_TOKEN_ENDPOINT: ${{ secrets.PUB_DEV_PUBLISH_TOKEN_ENDPOINT }}
    PUB_DEV_PUBLISH_EXPIRATION: ${{ secrets.PUB_DEV_PUBLISH_EXPIRATION }}
  run: |
    mkdir -p ~/.pub-cache
    cat <<EOF > ~/.pub-cache/pub-credentials.json
    {
      "accessToken":"${PUB_DEV_PUBLISH_ACCESS_TOKEN}",
      "refreshToken":"${PUB_DEV_PUBLISH_REFRESH_TOKEN}",
      "tokenEndpoint":"${PUB_DEV_PUBLISH_TOKEN_ENDPOINT}",
      "scopes":["https://www.googleapis.com/auth/userinfo.email","openid"],
      "expiration":${PUB_DEV_PUBLISH_EXPIRATION}
    }
    EOF
    chmod 600 ~/.pub-cache/pub-credentials.json

内容的提问来源于stack exchange，提问作者Kunchok Tashi