[Kebechet]

Switches the nuget.org push from the long-lived NUGET_API_KEY secret to NuGet trusted publishing (https://learn.microsoft.com/nuget/nuget-org/trusted-publishing).

• A NuGet/login@v1 step right before the nuget.org push trades the job's GitHub OIDC token for an API key that expires after an hour, and the push uses that key.
• The publishing job gets id-token: write.
• Everything else, including the GitHub Packages push (which keeps GITHUB_TOKEN), is unchanged.

The nuget.org trusted publishing policy for publish.yml is set up for Kebechet.Blazor.TanStack.VirtualCore.

Renaming a workflow file stops publishing until the policy on nuget.org is updated to match.

The NUGET_API_KEY repository secret is no longer read.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.69%. Comparing base (3c1f5bd) to head (725c505).

Additional details and impacted files

@@           Coverage Diff           @@
##             main       #3   +/-   ##
=======================================
  Coverage   71.69%   71.69%           
=======================================
  Files           6        6           
  Lines         265      265           
  Branches       41       41           
=======================================
  Hits          190      190           
  Misses         64       64           
  Partials       11       11           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🟢 Approval recommended

There are no active review issues blocking the NuGet trusted publishing migration.

No open issues 🎉

What changed in this PR

Migrates nuget.org publishing from a long-lived repository secret to NuGet trusted publishing, while leaving GitHub Packages publishing unchanged.

Changes:

• Grants the publishing job id-token: write for OIDC authentication.
• Adds NuGet/login@v1 immediately before the nuget.org push and uses its short-lived API key.
• Documents the NuGet account and workflow filename dependency of the trusted publishing policy.

File	Description
.github/​workflows/​publish.yml	Configures trusted publishing and replaces the nuget.org secret reference with the login action’s output.

_{Review effort: Balanced}