From 408d27c2b115ae2f5a7b6aa35fe568cdc660b082 Mon Sep 17 00:00:00 2001 From: "Steven T. Cramer" Date: Wed, 10 Jun 2026 12:49:33 +0700 Subject: [PATCH] feat: publish via NuGet Trusted Publishing (OIDC) Replace the expired PUBLISH_TO_NUGET_ORG secret with nuget/login@v1, matching timewarp-nuru. The job gets id-token: write and passes the short-lived OIDC-issued key to dev workflow --api-key. Co-Authored-By: Claude Fable 5 --- .github/workflows/workflow.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml index 03681ca..29e2d49 100644 --- a/.github/workflows/workflow.yml +++ b/.github/workflows/workflow.yml @@ -28,6 +28,9 @@ on: jobs: ci: runs-on: ubuntu-latest + permissions: + contents: read + id-token: write # Required for NuGet Trusted Publishing (OIDC) steps: - name: Checkout repository @@ -40,10 +43,17 @@ jobs: with: dotnet-version: '10.0.x' + - name: NuGet login (OIDC Trusted Publishing) + if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' + id: nuget-login + uses: nuget/login@v1 + with: + user: TimeWarp.Enterprises + - name: Run CI Pipeline run: | if [ "${{ github.event_name }}" == "release" ] || [ "${{ github.event_name }}" == "workflow_dispatch" ]; then - dotnet run --file tools/dev-cli/dev.cs -- workflow --api-key "${{ secrets.PUBLISH_TO_NUGET_ORG }}" + dotnet run --file tools/dev-cli/dev.cs -- workflow --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" else dotnet run --file tools/dev-cli/dev.cs -- workflow fi