fix: use dotnet nuget update source with raw PAT secret

Both previous approaches wrote credentials to the wrong NuGet config
path (~/. nuget/config/ is not scanned on Linux; NuGet reads
~/.nuget/NuGet/NuGet.Config). Credentials were silently ignored -> 401.

New approach:
- CI writes raw PAT to a temp file, passed as BuildKit secret id=nuget_pat
- Dockerfile uses `dotnet nuget update source` to inject credentials
  directly into nuget.config (the correct config file) before restore
- nuget.config is backed up and restored in the same RUN instruction so
  credentials never appear in the committed layer
- packageSourceMapping in nuget.config is fully preserved (only the
  <packageSourceCredentials> section is modified by update source)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: BenjaminMichaelis

.github/workflows/Build-Test-And-Deploy.yml

@@ -63,22 +63,9 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
-      - name: Generate NuGet auth config for Docker build
+      - name: Write NuGet PAT for Docker build
         if: github.event_name != 'pull_request' && github.event_name != 'merge_group'
-        env:
-          NUGET_AUTH_TOKEN: ${{ secrets.AZURE_DEVOPS_PAT }}
-        run: |
-          cat > /tmp/nuget-auth.config << EOF
-          <?xml version="1.0" encoding="utf-8"?>
-          <configuration>
-            <packageSourceCredentials>
-              <EssentialCSharp>
-                <add key="Username" value="docker" />
-                <add key="ClearTextPassword" value="${NUGET_AUTH_TOKEN}" />
-              </EssentialCSharp>
-            </packageSourceCredentials>
-          </configuration>
-          EOF
+        run: echo -n "${{ secrets.AZURE_DEVOPS_PAT }}" > ${{ runner.temp }}/nuget-pat.txt
 
 # Build but no push with a PR
       - name: Docker build (no push)
@@ -99,7 +86,7 @@ jobs:
           file: ./EssentialCSharp.Web/Dockerfile
           context: .
           secrets: |
-            "id=nugetconfig,src=/tmp/nuget-auth.config"
+            "id=nuget_pat,src=${{ runner.temp }}/nuget-pat.txt"
           outputs: type=docker,dest=${{ github.workspace }}/essentialcsharpwebimage.tar
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -109,9 +96,9 @@ jobs:
           name: essentialcsharpwebimage
           path: ${{ github.workspace }}/essentialcsharpwebimage.tar
 
-      - name: Clean up NuGet auth config
+      - name: Clean up NuGet PAT file
         if: always()
-        run: rm -f /tmp/nuget-auth.config
+        run: rm -f ${{ runner.temp }}/nuget-pat.txt
 
   deploy-development:
     if: github.event_name != 'pull_request_target' && github.event_name != 'pull_request'

EssentialCSharp.Web/Dockerfile

@@ -18,15 +18,19 @@ ENV ACCESS_TO_NUGET_FEED=$ACCESS_TO_NUGET_FEED
 WORKDIR /src
 COPY . .
 COPY --from=frontend-build /frontend/EssentialCSharp.Web/wwwroot/dist ./EssentialCSharp.Web/wwwroot/dist
-RUN --mount=type=secret,id=nugetconfig,required=false \
-    if [ "$ACCESS_TO_NUGET_FEED" = "true" ] && [ -f /run/secrets/nugetconfig ]; then \
-      mkdir -p ~/.nuget/config && \
-      cp /run/secrets/nugetconfig ~/.nuget/config/credentials.config; \
+RUN --mount=type=secret,id=nuget_pat,required=false \
+    if [ "$ACCESS_TO_NUGET_FEED" = "true" ] && [ -f /run/secrets/nuget_pat ]; then \
+      cp nuget.config nuget.config.bak && \
+      dotnet nuget update source EssentialCSharp \
+        --username docker \
+        --password "$(cat /run/secrets/nuget_pat)" \
+        --store-password-in-clear-text \
+        --configfile nuget.config; \
     fi && \
     dotnet restore "EssentialCSharp.Web.slnx" -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED && \
     dotnet build "EssentialCSharp.Web.slnx" -c Release --no-restore -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED -p:ReleaseDateAttribute=True -p:SkipFrontendBuild=true && \
     dotnet publish "EssentialCSharp.Web.slnx" -c Release -p:PublishDir=/app/publish -p:UseAppHost=false -p:SkipFrontendBuild=true --no-build && \
-    rm -f ~/.nuget/config/credentials.config
+    if [ -f nuget.config.bak ]; then mv nuget.config.bak nuget.config; fi
 
 FROM base AS final
 WORKDIR /app