From d3b917e677bb8f27762f9b8cc6b7651d74a1d8d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Schultz=20Madsen?= Date: Tue, 6 Oct 2026 08:31:22 +0200 Subject: [PATCH] ci: publish to nuget.org via Trusted Publishing (OIDC) Replace the long-lived NUGET_SECRET_KEY org secret with nuget.org Trusted Publishing: the publish job gets id-token: write and exchanges its GitHub OIDC token for a short-lived (1h) NuGet API key via NuGet/login@v1 (user: microtingas) right before the push. nuget.org API keys created before 2026-08-17 stop working on 2026-11-01, so the old secret would break publishing anyway. Requires a matching Trusted Publishing policy on nuget.org (owner microting, this repo, this workflow file) before merging. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/dotnet-core.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dotnet-core.yml b/.github/workflows/dotnet-core.yml index 507109b..d67894d 100644 --- a/.github/workflows/dotnet-core.yml +++ b/.github/workflows/dotnet-core.yml @@ -11,6 +11,9 @@ on: jobs: build: runs-on: ubuntu-latest + permissions: + id-token: write + contents: read steps: - uses: actions/checkout@v2 - name: Start MariaDB @@ -38,5 +41,10 @@ jobs: run: dotnet test --no-restore -c Release -v n Microting.eFormRentableItemBase.Unit.Tests/Microting.eFormRentableItemBase.Unit.Tests.csproj - name: Pack run: dotnet pack Microting.eFormRentableItemBase.sln -c Release -o ./artifacts -p:PackageVersion=${{ steps.get_version.outputs.VERSION }} + - name: NuGet login (OIDC trusted publishing) + uses: NuGet/login@v1 + id: nuget-login + with: + user: microtingas - name: Push generated package to GitHub registry - run: dotnet nuget push /home/runner/work/eform-RentableItem-Base/eform-RentableItem-Base/artifacts/Microting.eFormRentableItemBase.${{ steps.get_version.outputs.VERSION }}.nupkg -k ${{secrets.NUGET_SECRET_KEY}} -s https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols + run: dotnet nuget push /home/runner/work/eform-RentableItem-Base/eform-RentableItem-Base/artifacts/Microting.eFormRentableItemBase.${{ steps.get_version.outputs.VERSION }}.nupkg -k ${{ steps.nuget-login.outputs.NUGET_API_KEY }} -s https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols