Use Nuget trusted publishing
paydii committed
Aug 30, 2026 at 17:55 UTC
3a5200543f17d1fd38f996382d281759907741a1
1 file changed
+18
-3
.github/workflows/release-nuget.yml
+18
-3
@@ -253,6 +253,13 @@ jobs:
253
name: Publish to NuGet
254
runs-on: ubuntu-latest
255
needs: smoke-test
256
+ # Trusted Publishing exchanges a GitHub OIDC token for a short-lived NuGet
257
+ # API key, so no long-lived NUGET_API_KEY secret is stored. Requires the
258
+ # `sigit-nuget` trusted publisher policy on nuget.org (owner getsigit, repo
259
+ # sigit, workflow release-nuget.yml).
260
+ permissions:
261
+ contents: read
262
+ id-token: write
263
steps:
264
- name: Set the release version
265
shell: bash
@@ -288,13 +295,21 @@ jobs:
295
echo "exists=false" >> "$GITHUB_OUTPUT"
296
fi
297
298
+ # Exchange the workflow's OIDC token for a short-lived NuGet API key. The
299
+ # key is written to the environment for the subsequent `dotnet nuget push`
300
+ # via the NUGET_API_KEY variable this action sets.
301
+ - name: NuGet trusted-publishing login
302
+ if: steps.nuget-check.outputs.exists != 'true'
303
+ uses: NuGet/login@v1
304
+ id: nuget-login
305
+ with:
306
+ user: setoelkahfi
307
+
308
- name: Publish package
309
if: steps.nuget-check.outputs.exists != 'true'
293
- env:
294
- NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
310
shell: bash
311
run: |
312
dotnet nuget push nuget/dist/*.nupkg \
298
- --api-key "${NUGET_API_KEY}" \
313
+ --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" \
314
--source https://api.nuget.org/v3/index.json \
315
--skip-duplicate