From 61074eef2143353ee92ad32f65928b679e748a88 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 3 Nov 2026 18:59:33 +0000 Subject: [PATCH] Publish to NuGet through trusted publishing The publish job exchanges its OpenID Connect token for a short-lived API key with NuGet/login, using the trusted publishing policy of the nuget.org user that owns the package, so the NUGET_API_KEY secret is no longer used. A workflow_dispatch input allows publishing an existing tag on demand. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/publish.yml | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 65058c3..324c926 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -9,10 +9,19 @@ on: description: Release tag to publish, for example v3.1.0 required: true type: string + workflow_dispatch: + inputs: + tag: + description: Release tag to publish, for example v3.1.0 + required: true + type: string jobs: publish: runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v4 @@ -40,5 +49,14 @@ jobs: - name: Pack run: dotnet pack src/IPData/IPData.csproj --configuration Release --no-build --output ./nupkg /p:Version=${{ steps.version.outputs.VERSION }} + # Exchanges the job's OpenID Connect token for a short-lived NuGet API key + # through the trusted publishing policy of the nuget.org user "ipdata"; + # no long-lived API key is stored in the repository. + - name: Log in to NuGet + id: login + uses: NuGet/login@v1 + with: + user: ipdata + - name: Publish to NuGet - run: dotnet nuget push ./nupkg/*.nupkg --api-key ${{ secrets.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate + run: dotnet nuget push ./nupkg/*.nupkg --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate