Does publish_to: 'none' guarantee consistent blocking of package publishing across all Flutter CI/CD tools?

Direct Answer

No. publish_to: 'none' does not guarantee consistent blocking across all Flutter CI/CD tools or private pub servers. It is a client-side directive recognized by the official Dart and Flutter publish commands, not a universal enforcement mechanism.

Confirmed Facts

• In current stable Dart and Flutter toolchains, dart pub publish and flutter pub publish refuse to execute when publish_to: 'none' is set.
• The field has no effect on dependency resolution commands such as dart pub get or dart pub upgrade.
• Third-party CI/CD clients, custom scripts, and direct server API uploads are not bound by this setting and may ignore it.
• Private pub server implementations are not obligated to enforce the field server-side; acceptance depends on whether that server adds its own validation.

Likely Explanation

The publish_to key communicates intent to the official package client. Because it is metadata rather than an access-control token, any workflow that bypasses the official CLI can submit a package without encountering the check. Server-side rejection is a separate responsibility that each private pub implementation must handle independently.

Verification Steps

1. Run the official dry-run command to confirm the client-side block:

   flutter pub publish --dry-run

   or

   dart pub publish --dry-run

2. If you use a private pub server, attempt an upload through your pipeline to observe whether the server validates the publish_to value.
3. Audit CI/CD jobs to ensure they invoke the official CLI rather than custom scripts or direct HTTP calls that could bypass the check.

Missing Diagnostic Detail

Does your pipeline upload via the official CLI, or through a custom script/direct API? If it bypasses the official client, the recommendation shifts from relying on publish_to: 'none' to adding server-side or pipeline-level enforcement.