Skip to content

EX-3857 Publish SDK to NuGet via Trusted Publishing - #165

Merged
crhistianramirez merged 4 commits into
masterfrom
ex-3857-trusted-publishing
Aug 19, 2026
Merged

crhistianramirez merged 4 commits into
masterfrom
ex-3857-trusted-publishing

Conversation

@esitarz

@esitarz esitarz commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Switch publish.yml to NuGet Trusted Publishing (OIDC / NUGET_USER) instead of the yearly API key
  • Download the nupkg for the release tag that fired, not latest
  • When csproj version advances on master, publish the GitHub release (no more draft click)

Platform sync pipeline is a separate ADO PR: https://ordercloud.visualstudio.com/OC-Platform/_git/OC-Platform/pullrequest/8149

Test plan

Made with Cursor

@crhistianramirez

Copy link
Copy Markdown
Contributor

I don’t think the automatic release will trigger the NuGet publish workflow. GitHub prevents one workflow from starting another this way when using github.token. Could we run the NuGet publishing steps in the same workflow instead?

https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow#triggering-a-workflow-from-a-workflow

@esitarz
esitarz force-pushed the ex-3857-trusted-publishing branch from e331a25 to 9ac1ab5 Compare August 19, 2026 18:40
Eric Sitarz and others added 2 commits August 19, 2026 13:42
OIDC login replaces the expired API key, nupkg download is scoped
to the release tag, and a version bump on master publishes the
GitHub release so humans only review the PR.

Co-authored-by: Cursor <cursoragent@cursor.com>
Version tags can be moved; the SHA for v1.2.0 cannot.
@esitarz
esitarz force-pushed the ex-3857-trusted-publishing branch from 9ac1ab5 to ec16f2b Compare August 19, 2026 18:42
A GitHub release created with GITHUB_TOKEN does not start other
workflows. workflow_call keeps Trusted Publishing on publish.yml.
@esitarz
esitarz force-pushed the ex-3857-trusted-publishing branch from 032a2e3 to 964c9fe Compare August 19, 2026 18:49
checkout v5, setup-dotnet v5, and release-downloader v1.13 run on Node 24.
@esitarz
esitarz force-pushed the ex-3857-trusted-publishing branch from d0e1733 to be37cf0 Compare August 19, 2026 19:09
@crhistianramirez
crhistianramirez merged commit 5515d1d into master Aug 19, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants