From 6dc199a29728083eb257dce7225cab5f8b90c596 Mon Sep 17 00:00:00 2001 From: "Jeremy D. Miller" Date: Mon, 2 Nov 2026 11:45:43 -0600 Subject: [PATCH] Publish NuGet packages through trusted publishing publish_nugets.yml now gets its nuget.org key from NuGet/login, which trades the run's GitHub OIDC token for a short-lived API key under the trusted publishing policy already set up on nuget.org, instead of the long-lived NUGET_API_KEY secret. Same shape as JasperFx's manual publish workflow. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01DCggXgxnG3EBXoR9rrq37U --- .github/workflows/publish_nugets.yml | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish_nugets.yml b/.github/workflows/publish_nugets.yml index 4316b256ad..deadf059af 100644 --- a/.github/workflows/publish_nugets.yml +++ b/.github/workflows/publish_nugets.yml @@ -7,9 +7,18 @@ jobs: build: runs-on: ubuntu-latest + # NuGet trusted publishing: NuGet/login trades this run's GitHub OIDC token for a short-lived + # API key, under a trusted publishing policy on nuget.org owned by `jeremydmiller` that names this + # repository and THIS workflow file (publish_nugets.yml). Renaming the file breaks the policy until + # it is edited on nuget.org to match. Naming any permission drops the rest to none, so the + # checkout's contents: read is declared too. + permissions: + contents: read + id-token: write + steps: - uses: actions/checkout@v6 - + - name: Setup .NET 10 uses: actions/setup-dotnet@v5 with: @@ -19,8 +28,16 @@ jobs: run: ./build.sh pack shell: bash + - name: NuGet login + id: nuget_login + uses: NuGet/login@v1 + with: + user: jeremydmiller + - name: Publish to NuGet run: | - find . -name '*.nupkg' -exec dotnet nuget push "{}" -s https://api.nuget.org/v3/index.json -k ${{secrets.NUGET_API_KEY}} --skip-duplicate \; - # find . -name '*.snupkg' -exec dotnet nuget push "{}" -s https://api.nuget.org/v3/index.json -k ${{secrets.NUGET_API_KEY}} \; + find . -name '*.nupkg' -exec dotnet nuget push "{}" -s https://api.nuget.org/v3/index.json -k "$NUGET_API_KEY" --skip-duplicate \; + # find . -name '*.snupkg' -exec dotnet nuget push "{}" -s https://api.nuget.org/v3/index.json -k "$NUGET_API_KEY" \; + env: + NUGET_API_KEY: ${{ steps.nuget_login.outputs.NUGET_API_KEY }} shell: bash