From 83823277565f25c92c93d9307520abbb38e42c48 Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 15:57:12 +0900
Subject: [PATCH 1/4] ci: use OIDC for NuGet package push authentication

This updates the build-release workflow to leverage OpenID Connect (OIDC) for authenticating with NuGet.org. The package push operation is now performed directly within the build job, replacing static API key usage with ephemeral credentials for enhanced security.
---
 .github/workflows/build-release.yaml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index 6d58c4c..92c688d 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -29,6 +29,16 @@ jobs:
           name: nuget
           path: ./publish
           retention-days: 1
+      # push nuget
+      - name: NuGet login (OIDC)
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
+        id: login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+      - run: dotnet nuget push "./publish/*.nupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
+        if: ${{ !inputs.dry-run }}
+        env:
+          NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
 
   create-release:
     needs: [build-dotnet]
@@ -40,7 +50,7 @@ jobs:
       commit-id: ${{ github.sha }}
       tag: ${{ inputs.tag }}
       dry-run: ${{ inputs.dry-run }}
-      nuget-push: true
+      nuget-push: false
       release-upload: false
       release-format: "{0}"
     secrets: inherit

From 5858c6b872e7d6d30a84b73bc8f173fcbc72a8b6 Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 16:41:11 +0900
Subject: [PATCH 2/4] ci: id-token permission

---
 .github/workflows/build-release.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index 92c688d..2d80e25 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -16,6 +16,7 @@ jobs:
   build-dotnet:
     permissions:
       contents: read
+      id-token: write # required for NuGet Trusted Publish
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:

From de166830926b18a0e0f382a3fefa217eceac15ae Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 17:50:32 +0900
Subject: [PATCH 3/4] ci: handle SymbolPackageFormat on build

---
 .github/workflows/build-master.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-master.yaml b/.github/workflows/build-master.yaml
index c97bda0..e31a1cd 100644
--- a/.github/workflows/build-master.yaml
+++ b/.github/workflows/build-master.yaml
@@ -20,7 +20,7 @@ jobs:
       - uses: Cysharp/Actions/.github/actions/setup-dotnet@main
       - run: dotnet build -c Release -p:DefineConstants=RUNNING_IN_CI
       - run: dotnet test -c Release --no-build
-      - run: dotnet pack -c Release --no-build  -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o artifacts
+      - run: dotnet pack -c Release --no-build -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o artifacts
       - uses: Cysharp/Actions/.github/actions/upload-artifact@main
         with:
           name: nuget

From dac95704fba34f3808a7c5618743d493dfeea363 Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 18:19:59 +0900
Subject: [PATCH 4/4] ci: publish symbol files

---
 .github/workflows/build-release.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index 2d80e25..95090e4 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -40,6 +40,10 @@ jobs:
         if: ${{ !inputs.dry-run }}
         env:
           NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
+      - run: dotnet nuget push "./publish/*.snupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
+        if: ${{ !inputs.dry-run }}
+        env:
+          NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
 
   create-release:
     needs: [build-dotnet]