From f466bc299e73ed7741694bdeadbcf1e78120dd49 Mon Sep 17 00:00:00 2001 From: Damiaan Peeters Date: Sun, 14 Jun 2026 22:25:05 +0200 Subject: [PATCH 1/2] Remove manual OIDC token fetch; let NuGet CLI handle exchange MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Passing the raw GitHub OIDC JWT as --api-key doesn't work — NuGet rejects it with 403. The NuGet CLI (6.8+, bundled with .NET 8 SDK) performs the OIDC token exchange internally when id-token: write is set and no --api-key is provided. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/dotnet.yml | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 17731d8..7437c48 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -49,17 +49,7 @@ jobs: uses: actions/download-artifact@v4 with: name: nuget-packages - - name: Get NuGet OIDC token - id: oidc - uses: actions/github-script@v7 - with: - script: | - const token = await core.getIDToken('api.nuget.org'); - core.setSecret(token); - core.setOutput('token', token); - name: Push to NuGet - env: - NUGET_TOKEN: ${{ steps.oidc.outputs.token }} run: | - dotnet nuget push *.nupkg --source https://api.nuget.org/v3/index.json --api-key "$NUGET_TOKEN" --skip-duplicate - dotnet nuget push *.snupkg --source https://api.nuget.org/v3/index.json --api-key "$NUGET_TOKEN" --skip-duplicate + dotnet nuget push *.nupkg --source https://api.nuget.org/v3/index.json --skip-duplicate + dotnet nuget push *.snupkg --source https://api.nuget.org/v3/index.json --skip-duplicate From be601eee4e0541f8b3f8a9b992e83b65c34f1f3f Mon Sep 17 00:00:00 2001 From: Damiaan Peeters Date: Sun, 14 Jun 2026 22:27:01 +0200 Subject: [PATCH 2/2] Use NuGet/login@v1 for trusted publishing token exchange The official NuGet/login action exchanges the GitHub OIDC token for a short-lived nuget.org API key and exposes it as NUGET_API_KEY. Requires a NUGET_USER repo secret (value: dampeebe). The .snupkg symbol packages are pushed automatically alongside .nupkg. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/dotnet.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 7437c48..81d40ce 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -49,7 +49,14 @@ jobs: uses: actions/download-artifact@v4 with: name: nuget-packages + - name: NuGet login (Trusted Publishing) + uses: NuGet/login@v1 + id: login + with: + user: ${{ secrets.NUGET_USER }} - name: Push to NuGet - run: | - dotnet nuget push *.nupkg --source https://api.nuget.org/v3/index.json --skip-duplicate - dotnet nuget push *.snupkg --source https://api.nuget.org/v3/index.json --skip-duplicate + run: > + dotnet nuget push "*.nupkg" + --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" + --source https://api.nuget.org/v3/index.json + --skip-duplicate