Merge pull request #164 from Workiva/myeager-wf/gha-publish

Update GHA publishing steps

.github/workflows/publish.yaml

@@ -8,8 +8,33 @@ on:
       # Release Candidates
       - '[0-9]+.[0-9]+.[0-9]+-rc[0-9]+'
 
+permissions:
+  contents: write
+  id-token: write
+  pull-requests: write
+
 jobs:
+  create-sbom-release-asset:
+    name: Create SBOM Release Asset
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Publish SBOM to Release Assets
+        uses: anchore/sbom-action@v0
+        with:
+          path: ./
+          format: cyclonedx-json
   publish:
-    permissions:
-      id-token: write # Required for authentication using OIDC
-    uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1
+    name: Publish to pub.dev
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dart-lang/setup-dart@v1
+        with:
+          sdk: stable
+      - name: Install dependencies
+        run: dart pub get
+      - name: Publish - dry run
+        run: dart pub publish --dry-run --skip-validation
+      - name: Publish
+        run: dart pub publish -f