From bfb9f0eeb67d23854f6956fe04fd5641915083c8 Mon Sep 17 00:00:00 2001 From: Pete Deffendol Date: Wed, 2 Sep 2026 15:45:18 -0600 Subject: [PATCH 1/2] Enable nuget Trusted Publishing This replaces the explicit API key publish method. We must define a secret in the repo NUGET_USER which is the GitHub username of the person who has set up a trusted publishing configuration. --- .github/workflows/release.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f01403e..7f20d1d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,6 +6,7 @@ on: permissions: contents: write packages: write + id-token: write jobs: package: @@ -53,6 +54,13 @@ jobs: if: github.event.release.prerelease run: dotnet nuget push packages/*.nupkg --source https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json --api-key ${{ secrets.GITHUB_TOKEN }} + - name: NuGet login (OIDC → temp API key) + if: "!github.event.release.prerelease" + uses: NuGet/login@v1 + id: nuget-login + with: + user: ${{ secrets.NUGET_USER }} + - name: Push to nuget.org (stable only) if: "!github.event.release.prerelease" - run: dotnet nuget push packages/*.nupkg --api-key ${{ secrets.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json + run: dotnet nuget push packages/*.nupkg --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json From ab95308df67f19f6e891ba27b94dc00829b64862 Mon Sep 17 00:00:00 2001 From: Pete Deffendol Date: Wed, 2 Sep 2026 15:52:05 -0600 Subject: [PATCH 2/2] Quote API keys and skip duplicates on nuget push --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7f20d1d..13a685c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -52,7 +52,7 @@ jobs: - name: Push to GitHub Packages (pre-release only) if: github.event.release.prerelease - run: dotnet nuget push packages/*.nupkg --source https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json --api-key ${{ secrets.GITHUB_TOKEN }} + run: dotnet nuget push packages/*.nupkg --source https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json --api-key "${{ secrets.GITHUB_TOKEN }}" --skip-duplicate - name: NuGet login (OIDC → temp API key) if: "!github.event.release.prerelease" @@ -63,4 +63,4 @@ jobs: - name: Push to nuget.org (stable only) if: "!github.event.release.prerelease" - run: dotnet nuget push packages/*.nupkg --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json + run: dotnet nuget push packages/*.nupkg --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate