From 9124c08bf003edf85274252d656a2a3982ed78ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Schultz=20Madsen?= Date: Tue, 6 Oct 2026 08:32:47 +0200 Subject: [PATCH] ci: publish to nuget.org via Trusted Publishing (OIDC) Replace the long-lived NUGET_SECRET_KEY org secret with nuget.org Trusted Publishing: the publish job gets id-token: write and exchanges its GitHub OIDC token for a short-lived (1h) NuGet API key via NuGet/login@v1 (user: microtingas) right before the push. nuget.org API keys created before 2026-08-17 stop working on 2026-11-01, so the old secret would break publishing anyway. Requires a matching Trusted Publishing policy on nuget.org (owner microting, this repo, this workflow file) before merging. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/dotnet-release.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dotnet-release.yml b/.github/workflows/dotnet-release.yml index 3519d5033..a2b68de21 100644 --- a/.github/workflows/dotnet-release.yml +++ b/.github/workflows/dotnet-release.yml @@ -42,6 +42,9 @@ jobs: deploy: needs: [build-windows, build-ubuntu] runs-on: ubuntu-latest + permissions: + id-token: write + contents: read steps: - uses: actions/checkout@v3 - name: Setup .NET Core @@ -57,7 +60,12 @@ jobs: run: dotnet build --configuration Release - name: Pack run: dotnet pack Rebus8.sln -c Release -o ./artifacts -p:PackageVersion=${{ steps.get_version.outputs.VERSION }} + - name: NuGet login (OIDC trusted publishing) + uses: NuGet/login@v1 + id: nuget-login + with: + user: microtingas - name: Push generated Rebus package to GitHub registry - run: dotnet nuget push /home/runner/work/Rebus/Rebus/artifacts/Microting.Rebus.${{ steps.get_version.outputs.VERSION }}.nupkg -k ${{secrets.NUGET_SECRET_KEY}} -s https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols + run: dotnet nuget push /home/runner/work/Rebus/Rebus/artifacts/Microting.Rebus.${{ steps.get_version.outputs.VERSION }}.nupkg -k ${{ steps.nuget-login.outputs.NUGET_API_KEY }} -s https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols - name: Push generated Rebus.Tests.Contracts package to GitHub registry - run: dotnet nuget push /home/runner/work/Rebus/Rebus/artifacts/Microting.Rebus.Tests.Contracts.${{ steps.get_version.outputs.VERSION }}.nupkg -k ${{secrets.NUGET_SECRET_KEY}} -s https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols + run: dotnet nuget push /home/runner/work/Rebus/Rebus/artifacts/Microting.Rebus.Tests.Contracts.${{ steps.get_version.outputs.VERSION }}.nupkg -k ${{ steps.nuget-login.outputs.NUGET_API_KEY }} -s https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols