From 3a2fbd44c53c06e9b6d42a3120ebe4ff75e34534 Mon Sep 17 00:00:00 2001 From: ancplua Date: Fri, 26 Jun 2026 23:33:05 +0200 Subject: [PATCH] fix(template): set environment 'nuget' + concurrency on canonical nuget-publish The nuget.org Trusted Publisher policies for the .NET fleet repos (verified on Qyl.OpenTelemetry.SemanticConventions, .Autoinstrumentation, ancplua.evaluation.template) require Environment = 'nuget', but the canonical nuget-publish.yml set no `environment:` on the publish job. Every release therefore fails OIDC token exchange with: Token exchange failed (HTTP 401) ... Environment mismatch for policy '': expected 'nuget', actual '' Add `environment: nuget` to the publish job so the OIDC environment claim matches the policy. Also add a `concurrency` group (serialize releases per ref, never cancel an in-flight publish) so overlapping tag pushes can't race. Propagated to fleet repos via the next enforce-repo-settings sweep (or the targeted sync-nuget-publish.sh). Repos that pinned a per-repo CANONICAL-DEPARTURE for this exact reason can drop it once synced. Co-Authored-By: Claude Opus 4.8 (1M context) --- templates/nuget-publish.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/templates/nuget-publish.yml b/templates/nuget-publish.yml index 0b7dde0..894ae9b 100644 --- a/templates/nuget-publish.yml +++ b/templates/nuget-publish.yml @@ -61,9 +61,19 @@ permissions: id-token: write packages: write +concurrency: + # Serialize releases per ref; never cancel an in-flight publish (registries are immutable, + # so a half-published, cancelled run can strand artifacts). + group: nuget-publish-${{ github.ref }} + cancel-in-progress: false + jobs: publish: runs-on: ubuntu-latest + # Must match the nuget.org Trusted Publisher policy's Environment field. The policies for + # these repos use Environment 'nuget'; without this the OIDC token carries an empty environment + # claim and NuGet/login fails with HTTP 401 "Environment mismatch ... expected 'nuget', actual ''". + environment: nuget steps: - uses: actions/checkout@v6 with: