From 5a627d4aea664ce77eef35e886c787cb4cf33215 Mon Sep 17 00:00:00 2001 From: PFalkowski Date: Sat, 13 Jun 2026 19:47:31 +0200 Subject: [PATCH] Switch NuGet publish to Trusted Publishing (OIDC) Replace the long-lived NUGET_API_KEY secret with NuGet Trusted Publishing: grant the job id-token: write, exchange the GitHub OIDC token for a short-lived key via NuGet/login@v1, and push with that. The NuGet account username is read from the NUGET_USER repo variable. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/publish.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 717a805..7e75a73 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -12,6 +12,9 @@ on: jobs: publish: runs-on: ubuntu-latest + permissions: + contents: read + id-token: write # required to request the GitHub OIDC token for NuGet Trusted Publishing steps: - name: Checkout uses: actions/checkout@v6 @@ -44,5 +47,11 @@ jobs: - name: Pack run: dotnet pack Extensions.Standard/Extensions.Standard.csproj --configuration Release --output ./artifacts -p:Version=${{ steps.ver.outputs.version }} + - name: NuGet auth (Trusted Publishing via OIDC) + id: nuget-login + uses: NuGet/login@v1 + with: + user: ${{ vars.NUGET_USER }} + - name: Push to NuGet - run: dotnet nuget push "artifacts/*.nupkg" --api-key "${{ secrets.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate + run: dotnet nuget push "artifacts/*.nupkg" --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate