ci: use trusted publishing

Author: ascott18

.github/workflows/release.yml

@@ -5,6 +5,8 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
     - name: Checkout
       uses: actions/checkout@v2
@@ -25,10 +27,16 @@ jobs:
       run: dotnet test --configuration Release /p:Version=${VERSION} --no-build
     - name: Pack
       run: dotnet pack --configuration Release /p:Version=${VERSION} --no-build --output .
+
+    - name: NuGet login (OIDC → temp API key)
+      uses: NuGet/login@v1
+      id: login
+      with:
+        user: ascott18
+
     - name: Push
-      run: dotnet nuget push *.nupkg --source https://api.nuget.org/v3/index.json --api-key ${NUGET_KEY}
-      env:
-        NUGET_KEY: ${{ secrets.NUGET_KEY }}
+      run: dotnet nuget push *.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
+
     - name: Create GH Release
       uses: softprops/action-gh-release@v1
       with: