Skip to content

ci: publish to NuGet via Trusted Publishing, not a long-lived key #173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
phmatray merged 2 commits into from
Jul 27, 2026
Merged

ci: publish to NuGet via Trusted Publishing, not a long-lived key #173

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
db71a1e
ci: publish to NuGet via Trusted Publishing, not a long-lived key
phmatray Jul 25, 2026
3cbd38d
Merge remote-tracking branch 'origin/dev' into ci/nuget-trusted-publi…
phmatray Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 22 additions & 1 deletion .github/workflows/continuous.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ on:
permissions:
contents: write
packages: write
id-token: write # request the GitHub OIDC token for NuGet Trusted Publishing

jobs:
ubuntu-latest:
Expand All @@ -35,10 +36,30 @@ jobs:
.nuke/temp
~/.nuget/packages
key: ${{ runner.os }}-${{ hashFiles('global.json', '**/*.csproj') }}
# Trusted Publishing: exchanges the OIDC token for a NuGet key valid ~1 hour, so no long-lived
# secret is stored. Nuke reads it from the NUGET_API_KEY environment variable exactly as
# before, so build/Build.cs is unchanged — it neither knows nor cares that the key expires.
#
# Gated on a version tag, mirroring the build's own gate: Continuous triggers PublishIfNeeded,
# which is OnlyWhenStatic(IsOnVersionTag() && IsServerBuild) before it reaches Publish's
# Requires(NuGetApiKey). So a push to main/dev and every pull_request run leave the key unset
# today, and must keep doing so — minting a key on a pull request would both be pointless and
# fail outright for a fork, which cannot obtain this repository's OIDC token.
#
# Requires a Trusted Publishing policy on nuget.org for the FormCraft and
# FormCraft.ForMudBlazor packages, naming this repository and continuous.yml, plus the
# NUGET_USER secret (the nuget.org profile name).
- name: NuGet login (OIDC -> short-lived key)
id: nuget-login
if: startsWith(github.ref, 'refs/tags/v')
uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
with:
user: ${{ secrets.NUGET_USER }}

- name: 'Run: Continuous'
run: ./build.cmd Continuous
env:
NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
NUGET_API_KEY: ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: 'Publish: test-results'
uses: actions/upload-artifact@v7
Expand Down
6 changes: 5 additions & 1 deletion build/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,11 @@ scoop install git-cliff

### Environment Variables

- `NUGET_API_KEY`: Required for publishing to NuGet.org
- `NUGET_API_KEY`: Required for publishing to NuGet.org. In CI this is **not** a stored secret —
`continuous.yml` obtains a key valid about an hour from NuGet
[Trusted Publishing](https://learn.microsoft.com/nuget/nuget-org/trusted-publishing) via GitHub's
OIDC token, and passes it in through this same variable, so the build needs no change. Only a
local, manual publish uses a real API key you supply yourself.

### Parameters

Expand Down
Loading