Use trusted publishing for NuGet

[tobias-tengler]

No description provided.

[Copilot]

Pull request overview

This PR attempts to implement trusted publishing for NuGet packages by moving the id-token: write permission from the workflow level to the job level and introducing a NuGet login step to replace the direct use of API keys.

Changes:

• Moved id-token: write permission from workflow level to job level
• Added a new "NuGet login" step using NuGet/login@v1 action
• Changed the NuGet API key source from a direct secret to an output from the login step

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The GitHub Action NuGet/login@v1 does not exist in the GitHub Actions marketplace. As of January 2025, there is no official NuGet login action provided by NuGet or GitHub.

For trusted publishing with NuGet, you typically need to:

1. Configure trusted publishing on NuGet.org for your package(s) to trust GitHub Actions from your repository
2. Use the OIDC token (via id-token: write permission) directly with the NuGet API
3. Use dotnet nuget push with the --api-key parameter set to the OIDC token

The correct approach would be to either:

• Remove this login step entirely and configure the publish command to use OIDC tokens directly
• Use a valid community action if one exists (verify it exists first)
• Create a custom script to authenticate using OIDC

[Copilot]

The output steps.login.outputs.NUGET_API_KEY references a non-existent step output. Since the NuGet/login@v1 action does not exist (see previous comment), this output will not be available, causing the publish step to fail with an empty or undefined API key.

Additionally, trusted publishing with NuGet typically does not use API keys in the traditional sense - it uses OIDC tokens for authentication. The workflow should be updated to pass the appropriate authentication mechanism that NuGet's trusted publishing expects.

[github-actions]

🚀 Fusion Gateway Performance Results

Simple Composite Query

Constant Load (50 VUs)

Requests/sec	Error Rate
5888.51 req/s	0.00%

📊 Response Time Metrics

Min	Med	Max	Avg	P90	P95
0.76ms	7.08ms	162.25ms	8.34ms	12.76ms	18.12ms

Ramping Load (0→50→500→50 VUs)

Requests/sec	Error Rate
4562.59 req/s	0.00%

📊 Response Time Metrics

Min	Med	Max	Avg	P90	P95
0.72ms	38.50ms	241.94ms	48.60ms	109.93ms	128.87ms

Executed Query

fragment User on User {
  id
  username
  name
}

fragment Review on Review {
  id
  body
}

fragment Product on Product {
  inStock
  name
  price
  shippingEstimate
  upc
  weight
}

query TestQuery {
  topProducts(first: 5) {
    ...Product
    reviews {
      ...Review
      author {
        ...User
      }
    }
  }
}

Deep Recursion Query

Constant Load (50 VUs)

Requests/sec	Error Rate
272.26 req/s	0.00%

📊 Response Time Metrics

Min	Med	Max	Avg	P90	P95
12.78ms	173.08ms	564.66ms	178.13ms	223.09ms	245.93ms

Ramping Load (0→50→500→50 VUs)

Requests/sec	Error Rate
305.77 req/s	0.00%

📊 Response Time Metrics

Min	Med	Max	Avg	P90	P95
3.06ms	654.35ms	1708.90ms	689.61ms	1375.61ms	1462.42ms

Executed Query

fragment User on User {
  id
  username
  name
}

fragment Review on Review {
  id
  body
}

fragment Product on Product {
  inStock
  name
  price
  shippingEstimate
  upc
  weight
}

query TestQuery {
  users {
    ...User
    reviews {
      ...Review
      product {
        ...Product
        reviews {
          ...Review
          author {
            ...User
            reviews {
              ...Review
              product {
                ...Product
              }
            }
          }
        }
      }
    }
  }
  topProducts(first: 5) {
    ...Product
    reviews {
      ...Review
      author {
        ...User
        reviews {
          ...Review
          product {
            ...Product
          }
        }
      }
    }
  }
}

Variable Batching Throughput

Constant Load (50 VUs)

Requests/sec	Error Rate
23636.87 req/s	0.00%

📊 Response Time Metrics

Min	Med	Max	Avg	P90	P95
0.09ms	1.70ms	44.03ms	2.06ms	3.93ms	4.81ms

Ramping Load (0→50→500→50 VUs)

Requests/sec	Error Rate
18734.97 req/s	0.00%

📊 Response Time Metrics

Min	Med	Max	Avg	P90	P95
0.09ms	9.30ms	103.11ms	11.33ms	23.34ms	28.11ms

Executed Query

query TestQuery_8f7a46ce_2(
  $__fusion_1_upc: ID!
  $__fusion_2_price: Long!
  $__fusion_2_weight: Long!
) {
  productByUpc(upc: $__fusion_1_upc) {
    inStock
    shippingEstimate(weight: $__fusion_2_weight, price: $__fusion_2_price)
  }
}

Variables (5 sets batched in single request)

[
  { "__fusion_1_upc": "1", "__fusion_2_price": 899, "__fusion_2_weight": 100 },
  { "__fusion_1_upc": "2", "__fusion_2_price": 1299, "__fusion_2_weight": 1000 },
  { "__fusion_1_upc": "3", "__fusion_2_price": 15, "__fusion_2_weight": 20 },
  { "__fusion_1_upc": "4", "__fusion_2_price": 499, "__fusion_2_weight": 100 },
  { "__fusion_1_upc": "5", "__fusion_2_price": 1299, "__fusion_2_weight": 1000 }
]

No baseline data available for comparison.

---

Run 21713775950 • Commit d29e732 • Thu, 05 Feb 2026 14:00:42 GMT