Switch NuGet publishing to Trusted Publishing (OIDC)

Replaces the long-lived NUGET_API_KEY secret with a short-lived token
exchanged at publish time via NuGet/login@v1, scoped to the
nuget-release environment so only an approved run can ever obtain one.

Author: GREENFONTS

.github/workflows/release.yml

@@ -49,14 +49,17 @@ jobs:
           path: ./artifacts/*.nupkg
 
   # Requires manual approval before this job runs: configure a GitHub Environment named
-  # "nuget-release" (Settings > Environments) with required reviewers, and add NUGET_API_KEY as a
-  # secret scoped to that environment (not a repo-wide secret) so the key is only ever readable
-  # after someone approves. Until that environment is configured, this job has no reviewers
-  # assigned and nothing will publish - that's the intended state until this is explicitly set up.
+  # "nuget-release" (Settings > Environments) with required reviewers. Publishing uses NuGet
+  # Trusted Publishing (OIDC) - no NUGET_API_KEY secret needed. The matching trusted publishing
+  # policy on nuget.org must have Repository Owner=Monnify, Repository=monnify-dotnet-lib,
+  # Workflow File=release.yml, Environment=nuget-release, so a token is only trusted if it came
+  # from a run of this exact workflow that passed through this exact (approval-gated) environment.
   publish:
     needs: build-test-pack
     runs-on: ubuntu-latest
     environment: nuget-release
+    permissions:
+      id-token: write # required to request the GitHub OIDC token for NuGet Trusted Publishing
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -67,8 +70,17 @@ jobs:
         with:
           dotnet-version: "8.0.x"
 
+      # Exchanges the GitHub OIDC token for a short-lived (~1hr) NuGet API key - nothing
+      # long-lived is stored as a secret. NUGET_USER is just the nuget.org profile username
+      # (not the account email), kept as a secret only so it's not hardcoded here.
+      - name: NuGet login (OIDC -> temp API key)
+        uses: NuGet/login@v1
+        id: nuget_login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
       - name: Push to NuGet.org
-        run: dotnet nuget push "./artifacts/*.nupkg" --api-key "${{ secrets.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate
+        run: dotnet nuget push "./artifacts/*.nupkg" --api-key "${{ steps.nuget_login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2

CONTRIBUTING.md

@@ -43,8 +43,18 @@ Pushing a `vX.Y.Z` tag triggers [release.yml](.github/workflows/release.yml),
 which builds, tests, and packs, then **requires manual approval** before
 publishing: the publish job runs under a `nuget-release` GitHub Environment.
 Before the first release, that environment needs to be created (Settings →
-Environments) with required reviewers, plus a `NUGET_API_KEY` secret scoped
-to that environment specifically — not a repo-wide secret, so the key is only
-ever readable after someone approves. Until that's configured, the publish
-job has no reviewers and nothing will publish, which is the intended state
-until this is deliberately set up.
+Environments) with required reviewers.
+
+Publishing itself uses [NuGet Trusted Publishing](https://learn.microsoft.com/en-us/nuget/nuget-org/trusted-publishing)
+(OIDC) rather than a stored API key — the workflow exchanges a short-lived
+GitHub token for a temporary (~1hr) NuGet API key at publish time, so there's
+no long-lived secret to leak or rotate. This requires a matching policy on
+nuget.org (your account → Trusted Publishing) with Repository Owner=`Monnify`,
+Repository=`monnify-dotnet-lib`, Workflow File=`release.yml`,
+Environment=`nuget-release` — the environment restriction means a token is
+only trusted if it came from a run that passed through that approval gate.
+The only secret still needed is `NUGET_USER` (the nuget.org profile username,
+not the account email), scoped to the `nuget-release` environment. Until the
+environment and the nuget.org policy both exist, the publish job has no
+reviewers and nothing will publish, which is the intended state until this is
+deliberately set up.