From c5edc6e3c92e900f3ca74ac9aef63e4c05b80571 Mon Sep 17 00:00:00 2001 From: Daniel Gerlag Date: Thu, 24 Sep 2026 04:43:49 +0000 Subject: [PATCH] ci: publish NuGet packages via Trusted Publishing (OIDC) --- .github/workflows/nuget-publish.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/nuget-publish.yml b/.github/workflows/nuget-publish.yml index 657274ddb..51eeac422 100644 --- a/.github/workflows/nuget-publish.yml +++ b/.github/workflows/nuget-publish.yml @@ -6,6 +6,9 @@ on: jobs: publish: runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v4 @@ -27,5 +30,11 @@ jobs: - name: Pack run: dotnet pack --no-build -c Release -o ./nupkgs + - name: NuGet login (OIDC → temp API key) + uses: NuGet/login@v1 + id: login + with: + user: ${{ secrets.NUGET_USER }} + - name: Push to NuGet - run: dotnet nuget push ./nupkgs/*.nupkg --api-key ${{ secrets.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate + run: dotnet nuget push ./nupkgs/*.nupkg --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate