The release workflow still published to nuget.org with a long-lived API key secret. This updates the NuGet publish job to use GitHub OIDC trusted publishing and a short-lived credential issued at runtime.

• What changed

  • Added id-token: write to the nuget-publish job so GitHub Actions can request an OIDC token for nuget.org.
  • Added NuGet/login@v1 to exchange the OIDC token for a temporary NuGet API key.
  • Replaced the static NUGET_API_KEY secret in dotnet nuget push with the ephemeral key from the login step.

• Workflow impact

  • NuGet publishing no longer depends on a stored API key secret.
  • The job now aligns with nuget.org trusted publishing requirements and uses repository/workflow identity instead of a shared credential.

• Updated publish path

  permissions:
    contents: read
    id-token: write
  
  - name: Authenticate with NuGet.org
    id: login
    uses: NuGet/login@v1
    with:
      user: ${{ secrets.NUGET_USER }}
  
  - name: Push Package to NuGet
    run: dotnet nuget push --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source "https://api.nuget.org/v3/index.json" *.nupkg