Fix NuGet trusted publishing: remove manual OIDC token fetch#40
Merged
Conversation
Passing the raw GitHub OIDC JWT as --api-key doesn't work — NuGet rejects it with 403. The NuGet CLI (6.8+, bundled with .NET 8 SDK) performs the OIDC token exchange internally when id-token: write is set and no --api-key is provided. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The official NuGet/login action exchanges the GitHub OIDC token for a short-lived nuget.org API key and exposes it as NUGET_API_KEY. Requires a NUGET_USER repo secret (value: dampeebe). The .snupkg symbol packages are pushed automatically alongside .nupkg. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the NuGet publishing workflow to rely on NuGet/.NET’s built-in trusted publishing (OIDC) flow instead of manually fetching an OIDC JWT and passing it as an API key. This aligns the pipeline with how dotnet nuget push performs the OIDC token exchange when id-token: write is granted and no --api-key is supplied.
Changes:
- Removes the
actions/github-scriptstep that fetched an OIDC token forapi.nuget.org. - Removes passing the fetched token via
--api-keytodotnet nuget push, leaving push commands to run without an API key.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
actions/github-scriptOIDC token fetch step that was added in Switch NuGet publish to trusted publishing (OIDC) #39--api-key "$NUGET_TOKEN"from the push commandsWhy
Passing the raw GitHub OIDC JWT directly as
--api-keydoesn't work — NuGet returns 403. The NuGet CLI (6.8+, bundled with .NET 8 SDK) performs the OIDC token exchange internally whenid-token: writeis granted and no--api-keyis provided. TheACTIONS_ID_TOKEN_REQUEST_URL/ACTIONS_ID_TOKEN_REQUEST_TOKENenv vars are set automatically by the runner and the NuGet CLI uses them to fetch and exchange the token transparently.Test plan
mainand confirm thepublishjob completes without 403🤖 Generated with Claude Code