Use NuGet Trusted Publishing #1110
Conversation
Switch to using GitHub OIDC for pushing packages to NuGet.org with Trusted Publishing.
Done on both repos. Let me know if you need anything else 😃
Once we're 100% sure NTP works as intended, I'll take care of that 👍🏻 |
I hope it does, as I used it to publish this 😅 |
There was a problem hiding this comment.
Pull Request Overview
Migrates the NuGet package publishing workflow from using a static API key to GitHub OIDC-based Trusted Publishing for enhanced security. This change eliminates the need for storing a long-lived NuGet API key as a repository secret.
- Adds GitHub environment configuration for NuGet.org with required OIDC permissions
- Integrates NuGet login action to obtain temporary API key through trusted publishing
- Updates package push step to use dynamically generated API key
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
Looks like it's working. |
Great! I deleted the API key on NuGet.org and removed the corresponding secret here 😃 |
Switch to using GitHub OIDC for pushing packages to NuGet.org with Trusted Publishing.
@kevinchalet Could you update the repository configuration so this will work please?
Steps:
NuGet.orgNuGet.orgenvironment namedNUGET_USERwhose value is my NuGet.org username (it's not a secret, but I think it's better not to be hard-coded in the workflow 😃)NUGET_API_KEYsecret