From fcb2968b8ab16fb29b3caf5254805bc48321c3c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Schultz=20Madsen?= Date: Tue, 6 Oct 2026 08:29:09 +0200 Subject: [PATCH] ci: publish to nuget.org via Trusted Publishing (OIDC) Replace the long-lived NUGET_SECRET_KEY org secret with nuget.org Trusted Publishing: the publish job gets id-token: write and exchanges its GitHub OIDC token for a short-lived (1h) NuGet API key via NuGet/login@v1 (user: microtingas) right before the push. nuget.org API keys created before 2026-08-17 stop working on 2026-11-01, so the old secret would break publishing anyway. Requires a matching Trusted Publishing policy on nuget.org (owner microting, this repo, this workflow file) before merging. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/dotnet-core.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dotnet-core.yml b/.github/workflows/dotnet-core.yml index dfbe16e..fcc8f87 100644 --- a/.github/workflows/dotnet-core.yml +++ b/.github/workflows/dotnet-core.yml @@ -12,6 +12,9 @@ jobs: build: runs-on: ubuntu-latest + permissions: + id-token: write + contents: read steps: - uses: actions/checkout@v3 @@ -30,5 +33,10 @@ jobs: run: dotnet test --no-restore --verbosity normal - name: Pack run: dotnet pack eFormApi.BasePn/eFormApi.BasePn.csproj -c Release -o ./artifacts -p:PackageVersion=${{ steps.get_version.outputs.VERSION }} + - name: NuGet login (OIDC trusted publishing) + uses: NuGet/login@v1 + id: nuget-login + with: + user: microtingas - name: Push generated package to GitHub registry - run: dotnet nuget push /home/runner/work/eFormApi.BasePn/eFormApi.BasePn/artifacts/Microting.eFormApi.BasePn.${{ steps.get_version.outputs.VERSION }}.nupkg -k ${{secrets.NUGET_SECRET_KEY}} -s https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols + run: dotnet nuget push /home/runner/work/eFormApi.BasePn/eFormApi.BasePn/artifacts/Microting.eFormApi.BasePn.${{ steps.get_version.outputs.VERSION }}.nupkg -k ${{ steps.nuget-login.outputs.NUGET_API_KEY }} -s https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols