From a3cdcf1715606eb54528a9517093b83097de8c63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=82ngelo=20Tadeucci?= Date: Thu, 5 Nov 2026 15:37:34 -0300 Subject: [PATCH] Publish to NuGet through Trusted Publishing The NUGET_TOKEN API key expired, so the v2.4.36 release packed and tagged but failed to push. The release job now requests a GitHub OIDC token and exchanges it through NuGet/login for a one-hour API key, under the nuget.org Trusted Publishing policy for release.yml. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d9936b6..19eaf32 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,9 +39,11 @@ jobs: if: needs.check.outputs.should_release == 'true' runs-on: ubuntu-latest timeout-minutes: 20 - # Least privilege: only what is needed to push the tag and create the release. + # Least privilege: push the tag, create the release, and request the OIDC token that nuget.org + # Trusted Publishing exchanges for a one-hour API key. permissions: contents: write + id-token: write env: VERSION: ${{ needs.check.outputs.version }} steps: @@ -61,8 +63,13 @@ jobs: dotnet-version: 8.0.x - name: Pack run: dotnet pack --configuration Release --output . + - name: NuGet login + id: login + uses: NuGet/login@v1 + with: + user: AngeloTadeucci - name: Push - run: dotnet nuget push Maple2.File.Parser.Tadeucci.${VERSION}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_TOKEN }} + run: dotnet nuget push Maple2.File.Parser.Tadeucci.${VERSION}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ steps.login.outputs.NUGET_API_KEY }} - name: Check Available NuGet Package uses: BMTLab/nuget-package-check-action@v1.5.3 with: