From 1f44b0f2c8b7bf415387507a050ce8a8a5034caf Mon Sep 17 00:00:00 2001
From: Damiaan Peeters <damiaan.peeters@brainsolutions.be>
Date: Sun, 14 Jun 2026 22:07:29 +0200
Subject: [PATCH 1/2] Switch NuGet publish to trusted publishing (OIDC)

Replace API key secret with GitHub OIDC trusted publishing.
Adds id-token: write permission so the runner can obtain an OIDC
token that NuGet validates against the configured trusted publisher
policy, removing the need for a stored NUGET_PUBLISH_KEY secret.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/dotnet.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index ee87ee1..f819cbc 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -13,6 +13,9 @@ on:
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
     - uses: actions/checkout@v3
     - name: Setup .NET
@@ -27,8 +30,6 @@ jobs:
       run: dotnet pack --no-build --configuration Release PAYNLSDK/PayNLSdk.csproj --output .
     - name: Push Nuget
       if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/release/v') }}
-      env:
-        NUGET_API_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
       run: |
-        dotnet nuget push *.nupkg --source https://api.nuget.org/v3/index.json --api-key "$NUGET_API_KEY" --skip-duplicate
-        dotnet nuget push *.snupkg --source https://api.nuget.org/v3/index.json --api-key "$NUGET_API_KEY" --skip-duplicate
+        dotnet nuget push *.nupkg --source https://api.nuget.org/v3/index.json --skip-duplicate
+        dotnet nuget push *.snupkg --source https://api.nuget.org/v3/index.json --skip-duplicate

From f481866ad1a98d88253fc8da0b517dce76a9eaa7 Mon Sep 17 00:00:00 2001
From: Damiaan Peeters <damiaan.peeters@brainsolutions.be>
Date: Sun, 14 Jun 2026 22:13:10 +0200
Subject: [PATCH 2/2] Split publish into separate job, fetch OIDC token
 explicitly

- Move NuGet push into a dedicated publish job with needs: build
  so id-token: write is never granted during PR builds
- Fetch the OIDC token (audience api.nuget.org) via actions/github-script
  and pass it as --api-key so the push authenticates correctly
- Pass packages between jobs via upload/download-artifact@v4

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/dotnet.yml | 46 +++++++++++++++++++++++++++++-------
 1 file changed, 38 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index f819cbc..17731d8 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -11,11 +11,8 @@ on:
   workflow_dispatch:
 
 jobs:
-  build-and-publish:
+  build:
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      contents: read
     steps:
     - uses: actions/checkout@v3
     - name: Setup .NET
@@ -28,8 +25,41 @@ jobs:
       run: dotnet build --configuration Release --no-restore
     - name: Pack
       run: dotnet pack --no-build --configuration Release PAYNLSDK/PayNLSdk.csproj --output .
-    - name: Push Nuget
-      if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/release/v') }}
+    - name: Upload packages
+      uses: actions/upload-artifact@v4
+      with:
+        name: nuget-packages
+        path: |
+          *.nupkg
+          *.snupkg
+
+  publish:
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/release/v')
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v3
+      with:
+        dotnet-version: 8.0.x
+    - name: Download packages
+      uses: actions/download-artifact@v4
+      with:
+        name: nuget-packages
+    - name: Get NuGet OIDC token
+      id: oidc
+      uses: actions/github-script@v7
+      with:
+        script: |
+          const token = await core.getIDToken('api.nuget.org');
+          core.setSecret(token);
+          core.setOutput('token', token);
+    - name: Push to NuGet
+      env:
+        NUGET_TOKEN: ${{ steps.oidc.outputs.token }}
       run: |
-        dotnet nuget push *.nupkg --source https://api.nuget.org/v3/index.json --skip-duplicate
-        dotnet nuget push *.snupkg --source https://api.nuget.org/v3/index.json --skip-duplicate
+        dotnet nuget push *.nupkg --source https://api.nuget.org/v3/index.json --api-key "$NUGET_TOKEN" --skip-duplicate
+        dotnet nuget push *.snupkg --source https://api.nuget.org/v3/index.json --api-key "$NUGET_TOKEN" --skip-duplicate