From d4676bfc59e4ca6a4eacef22e541d831f2bdc1b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9=20Schultz=20Madsen?= <rm@microting.dk>
Date: Tue, 6 Oct 2026 08:29:21 +0200
Subject: [PATCH] ci: publish to nuget.org via Trusted Publishing (OIDC)

Replace the long-lived NUGET_SECRET_KEY org secret with nuget.org
Trusted Publishing: the publish job gets id-token: write and exchanges
its GitHub OIDC token for a short-lived (1h) NuGet API key via
NuGet/login@v1 (user: microtingas) right before the push.

nuget.org API keys created before 2026-08-17 stop working on
2026-11-01, so the old secret would break publishing anyway.

Requires a matching Trusted Publishing policy on nuget.org
(owner microting, this repo, this workflow file) before merging.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/dotnet-core.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dotnet-core.yml b/.github/workflows/dotnet-core.yml
index d9a24d8..d125ed6 100644
--- a/.github/workflows/dotnet-core.yml
+++ b/.github/workflows/dotnet-core.yml
@@ -11,6 +11,9 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
     - uses: actions/checkout@v3
     - name: Start MariaDB
@@ -33,8 +36,13 @@ jobs:
       run: dotnet test --no-restore -c Release -v n Microting.EformAngularFrontendBase.Tests/Microting.EformAngularFrontendBase.Tests.csproj
     - name: Pack
       run: dotnet pack Microting.EformAngularFrontendBase/Microting.EformAngularFrontendBase.csproj -c Release -o ./artifacts -p:PackageVersion=${{ steps.get_version.outputs.VERSION }}
+    - name: NuGet login (OIDC trusted publishing)
+      uses: NuGet/login@v1
+      id: nuget-login
+      with:
+        user: microtingas
     - name: Push generated package to GitHub registry
-      run: dotnet nuget push /home/runner/work/eform-angular-frontend-base/eform-angular-frontend-base/artifacts/Microting.EformAngularFrontendBase.${{ steps.get_version.outputs.VERSION }}.nupkg -k ${{secrets.NUGET_SECRET_KEY}} -s https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols
+      run: dotnet nuget push /home/runner/work/eform-angular-frontend-base/eform-angular-frontend-base/artifacts/Microting.EformAngularFrontendBase.${{ steps.get_version.outputs.VERSION }}.nupkg -k ${{ steps.nuget-login.outputs.NUGET_API_KEY }} -s https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols
     - name: Notify slack fail
       if: ${{ failure() }}
       env: