From 725c5058be310e66a37227ccebe5096dd275a313 Mon Sep 17 00:00:00 2001
From: Kebechet <samosidor@gmail.com>
Date: Mon, 2 Nov 2026 09:38:29 +0100
Subject: [PATCH] Publish to nuget.org with trusted publishing instead of an
 API key

nuget.org trades the job's GitHub OIDC token for an API key that lives
one hour, so no long-lived key is stored in the repository. The policy
on nuget.org names this repository and the workflow file publish.yml.

https://learn.microsoft.com/nuget/nuget-org/trusted-publishing
---
 .github/workflows/publish.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5b0d9ca..8683afa 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -11,6 +11,8 @@ env:
   BUILD_CONFIGURATION: Release
   OUTPUT_PATH: ./nupkg
   NUGET_SOURCE: https://api.nuget.org/v3/index.json
+  # nuget.org profile name (not the email) that owns the trusted publishing policy
+  NUGET_USER: Kebechet
 
 jobs:
   publish:
@@ -18,6 +20,7 @@ jobs:
     permissions:
       contents: write
       packages: write
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -64,8 +67,18 @@ jobs:
           echo "$CONTENTS" | grep -q "staticwebassets/adaptive-virtualize-interop.js"   || { echo "::error::interop module missing from package"; exit 1; }
           echo "$CONTENTS" | grep -q "build/Kebechet.Blazor.TanStack.VirtualCore.props"  || { echo "::error::build props missing from package"; exit 1; }
 
+      # Trusted publishing (https://learn.microsoft.com/nuget/nuget-org/trusted-publishing): nuget.org
+      # trades this job's GitHub OIDC token for an API key that expires after an hour, so the login sits
+      # after the slow test steps. The nuget.org policy names this repository and the file name
+      # publish.yml - renaming this file stops publishing until the policy is updated to match.
+      - name: NuGet login (trusted publishing)
+        id: nuget-login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ env.NUGET_USER }}
+
       - name: Publish to NuGet
-        run: dotnet nuget push ${{ env.OUTPUT_PATH }}/*.nupkg --api-key ${{ secrets.NUGET_API_KEY }} --source ${{ env.NUGET_SOURCE }} --skip-duplicate
+        run: dotnet nuget push ${{ env.OUTPUT_PATH }}/*.nupkg --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --source ${{ env.NUGET_SOURCE }} --skip-duplicate
 
       - name: Publish to GitHub Packages
         run: dotnet nuget push ${{ env.OUTPUT_PATH }}/*.nupkg --api-key ${{ secrets.GITHUB_TOKEN }} --source https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json --skip-duplicate