Trusted Publishers - Beta

OnePub supports Trusted Publisher allowing you to publishing directly from your preferred CI/CD provider without using a token.

A Trusted Provider, using OIDC, can be 'paired' with OnePub on a per package basis. This simplifies the publishing process while enhancing security by removing the need for long lived security tokens.

OnePub supports the following Publishers:

• GitHub

• GitLab

• Bitbucket

• CircleCI

• Azure Pipelines

Once a Trusted Provider is paired to OnePub, publish a package from your CI/CD pipeline use:

dart pub global activate onepub
onepub login trusted
dart pub publish --force

Establishing Trust

To setup a Trusted Provider, you must 'pair' the provider with each package that you will publish to OnePub.

Log in to the OnePub website: https://onepub.dev

Navigate to: My OnePub | Managed Packages

Select the package you want to publish.

On the right hand side of the screen, select the 'Trusted publishing' tab.

Click 'New Publisher'.

Select the provider from which you run you CI/CD pipeline.

The 'Help' tab on the right-hand side of your screen provides details about configuring each supported Publisher.

Once you have entered all of the required details click the 'Save' button.

If you have an existing CI/CD pipeline then remove the onepub import command and replace it with onepub login trusted

You can also remove the OnePub token from your environment settings. We also recommend that you disable your OnePub CI/CD account to prevent it being used.

You can now trigger your CI/CD pipeline.

Repeat the above process for each of your packages that are published into OnePub.