From 313e9403ecd0124fe68b2c4b6dd0426ca10ee9f9 Mon Sep 17 00:00:00 2001 From: Gerald Versluis Date: Fri, 3 Jul 2026 09:37:49 +0200 Subject: [PATCH 1/2] Use trusted publishing for NuGet release Switch the NuGet.org release workflow from the long-lived package push token to NuGet trusted publishing via OIDC login. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/dotnet-build.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dotnet-build.yml b/.github/workflows/dotnet-build.yml index c844b022d8..ab9d4a066c 100644 --- a/.github/workflows/dotnet-build.yml +++ b/.github/workflows/dotnet-build.yml @@ -382,6 +382,9 @@ jobs: if: ${{ startsWith(github.ref, 'refs/tags/') }} needs: [ sign ] environment: nuget-release-gate # This gates this job until manually approved + permissions: + id-token: write + contents: read runs-on: ubuntu-latest steps: @@ -397,10 +400,16 @@ jobs: name: signed-packages path: ./packages + - name: NuGet login (OIDC) + id: login + uses: NuGet/login@v1 + with: + user: ${{ secrets.NUGET_USER }} + - name: Push to NuGet.org run: > dotnet nuget push **/*.nupkg --source https://api.nuget.org/v3/index.json - --api-key ${{ secrets.NUGET_PACKAGE_PUSH_TOKEN }} + --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --skip-duplicate From b507b2abe3be2950a777f70a0b8dfbdf4c8b7a12 Mon Sep 17 00:00:00 2001 From: Gerald Versluis Date: Fri, 3 Jul 2026 09:43:00 +0200 Subject: [PATCH 2/2] Pin NuGet login action Keep the trusted publishing action pinned by commit SHA like the other workflow actions in this repo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/dotnet-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dotnet-build.yml b/.github/workflows/dotnet-build.yml index ab9d4a066c..54511def35 100644 --- a/.github/workflows/dotnet-build.yml +++ b/.github/workflows/dotnet-build.yml @@ -402,7 +402,7 @@ jobs: - name: NuGet login (OIDC) id: login - uses: NuGet/login@v1 + uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1 with: user: ${{ secrets.NUGET_USER }}