fix: use dotnet nuget update source for Docker NuGet auth

The previous approach copied credentials to ~/.nuget/config/credentials.config,
which is NOT a path the .NET SDK reads on Linux. The NuGet client only reads
user-level config from ~/.nuget/NuGet/NuGet.Config.

Replace the broken config-layering approach with 'dotnet nuget update source',
which injects credentials into the repo's nuget.config in the build stage.
This preserves packageSourceMapping and uses no external tooling.

Also fixes:
- Semicolon (;) after dotnet restore replaced with && to fail fast
- CI now passes raw PAT as BuildKit secret instead of generating XML
- Uses runner.temp instead of /tmp for the PAT file

Author: BenjaminMichaelis

.github/workflows/Build-Test-And-Deploy.yml

@@ -63,25 +63,9 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
-      - name: Generate NuGet auth config for Docker build
+      - name: Write NuGet PAT for Docker build
         if: github.event_name != 'pull_request' && github.event_name != 'merge_group'
-        env:
-          NUGET_AUTH_TOKEN: ${{ secrets.AZURE_DEVOPS_PAT }}
-        run: |
-          # Credentials-only config — sources and packageSourceMapping remain in nuget.config.
-          # NuGet merges packageSourceCredentials from ~/.nuget/config/*.config independently
-          # of packageSources, so <clear /> in nuget.config does not affect credentials.
-          cat > /tmp/nuget-auth.config << EOF
-          <?xml version="1.0" encoding="utf-8"?>
-          <configuration>
-            <packageSourceCredentials>
-              <EssentialCSharp>
-                <add key="Username" value="docker" />
-                <add key="ClearTextPassword" value="${NUGET_AUTH_TOKEN}" />
-              </EssentialCSharp>
-            </packageSourceCredentials>
-          </configuration>
-          EOF
+        run: echo "${{ secrets.AZURE_DEVOPS_PAT }}" > "${{ runner.temp }}/nuget-pat.txt"
 
 # Build but no push with a PR
       - name: Docker build (no push)
@@ -102,7 +86,7 @@ jobs:
           file: ./EssentialCSharp.Web/Dockerfile
           context: .
           secrets: |
-            "id=nugetconfig,src=/tmp/nuget-auth.config"
+            "id=nuget_pat,src=${{ runner.temp }}/nuget-pat.txt"
           outputs: type=docker,dest=${{ github.workspace }}/essentialcsharpwebimage.tar
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -112,9 +96,9 @@ jobs:
           name: essentialcsharpwebimage
           path: ${{ github.workspace }}/essentialcsharpwebimage.tar
 
-      - name: Clean up NuGet auth config
+      - name: Clean up NuGet PAT
         if: always()
-        run: rm -f /tmp/nuget-auth.config
+        run: rm -f "${{ runner.temp }}/nuget-pat.txt"
 
   deploy-development:
     if: github.event_name != 'pull_request_target' && github.event_name != 'pull_request'

EssentialCSharp.Web/Dockerfile

@@ -18,11 +18,14 @@ ENV ACCESS_TO_NUGET_FEED=$ACCESS_TO_NUGET_FEED
 WORKDIR /src
 COPY . .
 COPY --from=frontend-build /frontend/EssentialCSharp.Web/wwwroot/dist ./EssentialCSharp.Web/wwwroot/dist
-RUN --mount=type=secret,id=nugetconfig,required=false \
-    if [ -f /run/secrets/nugetconfig ]; then \
-      mkdir -p ~/.nuget/config && cp /run/secrets/nugetconfig ~/.nuget/config/credentials.config; \
+RUN --mount=type=secret,id=nuget_pat,required=false \
+    if [ "$ACCESS_TO_NUGET_FEED" = "true" ] && [ -f /run/secrets/nuget_pat ]; then \
+      dotnet nuget update source EssentialCSharp \
+        --username az \
+        --password "$(cat /run/secrets/nuget_pat)" \
+        --store-password-in-clear-text; \
     fi && \
-    dotnet restore "EssentialCSharp.Web.slnx" -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED; \
+    dotnet restore "EssentialCSharp.Web.slnx" -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED && \
     dotnet build "EssentialCSharp.Web.slnx" -c Release --no-restore -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED -p:ReleaseDateAttribute=True -p:SkipFrontendBuild=true && \
     dotnet publish "EssentialCSharp.Web.slnx" -c Release -p:PublishDir=/app/publish -p:UseAppHost=false -p:SkipFrontendBuild=true --no-build