Skip to content

Commit 2f98c14

Browse files
mgravellmgravell
authored
Switch NuGet release publishing from API key to OIDC trusted publishing (#568)
* Switch NuGet release publishing from API key to OIDC trusted publishing Replaces the long-lived NUGET_API_KEY secret with GitHub OIDC token exchange via NuGet/login@v1, keeping --skip-duplicate so a job retry after a partial failure doesn't fail on the already-published version. * Scope release job to the release GitHub Environment for OIDC Matches the Environment field on the nuget.org Trusted Publishing policy, so the OIDC token carries the environment claim it expects.
1 parent ca66d2e commit 2f98c14

1 file changed

Lines changed: 12 additions & 6 deletions

File tree

‎.github/workflows/nuget-release.yml‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ on:
77
jobs:
88
build:
99
runs-on: ubuntu-latest
10+
environment: release
11+
permissions:
12+
contents: read
13+
id-token: write
1014
steps:
1115
- uses: actions/checkout@v6
1216
- name: Set up .NET 10
@@ -58,10 +62,12 @@ jobs:
5862
5963
- name: Build
6064
run: dotnet pack -c Release --output .
61-
- name: Publish
62-
uses: alirezanet/publish-nuget@v3.0.3
65+
66+
- name: NuGet login (OIDC -> temp API key)
67+
uses: NuGet/login@v1
68+
id: login
6369
with:
64-
NUGET_KEY: ${{secrets.NUGET_API_KEY}}
65-
PROJECT_FILE_PATH: src/NRedisStack/NRedisStack.csproj
66-
PACKAGE_NAME: NRedisStack
67-
TAG_COMMIT: false
70+
user: ${{ secrets.NUGET_USER }}
71+
72+
- name: Publish
73+
run: dotnet nuget push ./*.nupkg --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate

0 commit comments

Comments
 (0)