From 20154d486ad8e6fee2be33bb477884f252bada79 Mon Sep 17 00:00:00 2001
From: Danielku15 <danielku15@coderline.net>
Date: Sun, 1 Nov 2026 10:59:59 +0100
Subject: [PATCH] ci: publish the NuGet packages via trusted publishing

The .NET publish job exchanges a GitHub OIDC token for a short-lived
nuget.org API key (NuGet/login) right before pushing, replacing the
long-lived NUGET_API_KEY secret. The job and its callers in Publish and
Release grant id-token: write.

nuget.org matches its trust policy against the job_workflow_ref claim,
which names ~publish_dotnet.yml rather than the calling workflow, so a
single policy covers nightly and release publishing. NUGET_USER holds
the nuget.org account that created the policy. Dry runs also request a
key, so they verify the policy without pushing.
---
 .github/workflows/publish.yml         |  3 +++
 .github/workflows/release.yml         |  3 +++
 .github/workflows/~publish_dotnet.yml | 10 +++++++++-
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7055d4c91..c3d880862 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -45,6 +45,9 @@ jobs:
   dotnet:
     if: inputs.dotnet
     uses: ./.github/workflows/~publish_dotnet.yml
+    permissions:
+      contents: read
+      id-token: write
     secrets: inherit
     with:
       version: alpha ${{github.run_number}}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2b704932a..4c40ef176 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,6 +43,9 @@ jobs:
 
   dotnet:
     uses: ./.github/workflows/~publish_dotnet.yml
+    permissions:
+      contents: read
+      id-token: write
     secrets: inherit
     if: (github.event_name == 'push') || (github.event_name == 'workflow_dispatch' && github.event.inputs.release_csharp == 'true')
     with: 
diff --git a/.github/workflows/~publish_dotnet.yml b/.github/workflows/~publish_dotnet.yml
index 7795c2902..4970daace 100644
--- a/.github/workflows/~publish_dotnet.yml
+++ b/.github/workflows/~publish_dotnet.yml
@@ -14,6 +14,9 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v7
         with: 
@@ -31,6 +34,11 @@ jobs:
       - run: npm run build-csharp
 
       - run: npm run nightly-pack -- --platform dotnet --force ${{ inputs.force }}
+      # nuget.org trusted publishing: the policy matches this file (job_workflow_ref), not the calling workflow
+      - uses: NuGet/login@v1
+        id: nuget_login
+        with:
+          user: ${{ secrets.NUGET_USER }}
       - run: npm run nightly-publish -- --platform dotnet --force ${{ inputs.force }} --dry-run ${{ inputs.dry_run }}
         env:
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+          NUGET_API_KEY: ${{ steps.nuget_login.outputs.NUGET_API_KEY }}