From 874242a5901434208df47f95c83b01977413d432 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jacek=20=C5=81api=C5=84ski?= Date: Wed, 11 Nov 2026 16:08:27 +0100 Subject: [PATCH] ci: publish to NuGet with Trusted Publishing instead of an API key The NuGet API key in NUGET_API_KEY expired and the 2.0.1 publish failed with 403. NuGet/login exchanges the workflow's OIDC token for a short-lived API key, so the repository keeps no long-lived key. Needs the nuget.org policy (owner kododo-dev, repository kododo-dev/RunWay, workflow publish-nuget.yml, packages Kododo.RunWay*) and the NUGET_USER variable (nuget.org user name). Co-Authored-By: Claude Opus 5.5 --- .github/workflows/publish-nuget.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-nuget.yml b/.github/workflows/publish-nuget.yml index 3cf71a8..612b68d 100644 --- a/.github/workflows/publish-nuget.yml +++ b/.github/workflows/publish-nuget.yml @@ -8,6 +8,11 @@ on: jobs: publish: runs-on: ubuntu-latest + # Trusted Publishing: nuget.org exchanges the workflow's OIDC token for a short-lived API key, so the repository + # keeps no NuGet API key. Policy on nuget.org: owner kododo-dev, this repository, workflow publish-nuget.yml. + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v4 @@ -90,9 +95,15 @@ jobs: -p:Version=${{ steps.version.outputs.VERSION }} \ --output ./nupkgs + - name: NuGet login (Trusted Publishing) + id: nuget-login + uses: NuGet/login@v1 + with: + user: ${{ vars.NUGET_USER }} + - name: Push to NuGet run: | dotnet nuget push ./nupkgs/*.nupkg \ - --api-key ${{ secrets.NUGET_API_KEY }} \ + --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} \ --source https://api.nuget.org/v3/index.json \ --skip-duplicate