Add nuget-trusted-publishing skill by lewing · Pull Request #34 · dotnet/skills

lewing · 2026-02-17T23:11:47Z

Add nuget-trusted-publishing skill

Knowledge-driven skill for setting up NuGet trusted publishing (OIDC) on GitHub Actions repos -- replacing long-lived API keys with short-lived tokens.

5-Phase Process

Discovery -- detect packable projects, classify package type (library/tool/MCP/template)
Structure Validation -- verify MSBuild properties and supporting files
Local Pre-Publish Testing -- pack and test locally before configuring nuget.org
nuget.org Policy Setup -- guide through trusted publishing policy + GitHub Environment creation
Workflow Setup -- create or modify publish workflow with OIDC auth

Files

SKILL.md -- orchestrating skill (~1900 tokens)
references/package-types.md -- per-type structural requirements and detection logic
references/publish-workflow.md -- complete tag-triggered workflow template

Validated against

Real MCP server publish session (helix.mcp -- greenfield, environment secrets, server.json versioning)
Real dotnet tool publish session (dotnet-replay -- greenfield, GitHub Release conflicts, re-run gotchas)
Multi-model review (Sonnet 4, GPT-5)
Skill-builder best practices checklist

Copilot

Pull request overview

This PR adds a comprehensive knowledge-driven skill for setting up NuGet trusted publishing (OIDC) on GitHub Actions repositories, replacing long-lived API keys with secure short-lived tokens. The skill provides a structured 5-phase process: discovery, structure validation, local testing, nuget.org policy setup, and workflow configuration.

Changes:

Adds nuget-trusted-publishing skill with complete OIDC setup guidance
Provides detailed package type detection logic and structural requirements for libraries, dotnet tools, MCP servers, and template packages
Includes a production-ready GitHub Actions workflow template with tag-triggered publishing
Registers the new skill in the marketplace plugin configuration

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
`skills/nuget-trusted-publishing/SKILL.md`	Main orchestrating skill (200 lines) defining the 5-phase trusted publishing setup process with safety rules and common blockers
`skills/nuget-trusted-publishing/references/package-types.md`	Comprehensive reference for detecting and validating NuGet package types with minimal .csproj examples and gotchas
`skills/nuget-trusted-publishing/references/publish-workflow.md`	Complete tag-triggered GitHub Actions workflow template with customization guidance and optional GitHub Release integration
`.github/plugin/marketplace.json`	Registers the new skill in the core-skills plugin collection

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

jeffschwMSFT

@lewing can you share the evaluator output? I added a peer from nuget to take a look as well

Knowledge-driven skill for setting up NuGet trusted publishing (OIDC) on GitHub Actions repos. Guides users through a 5-phase process: discovery, structure validation, local testing, nuget.org policy setup, and workflow creation/modification. Supports library, dotnet tool, MCP server, and template package types with per-type structural requirements and a complete tag-triggered workflow template. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Merge 5 phases into 4 (Discovery + Structure Validation → Assess) - Fix nuget.org URL to correct https://www.nuget.org/account/trustedpublishing - Add contents: read to migration YAML snippet (prevents checkout failures) - Add MCP server version-sync check (.csproj ↔ server.json) - Clarify environment name is convention not requirement - Restore policy owner (user vs org) guidance - Add multi-project repo note - Fix .yml/.yaml extension guidance - Add Version to dotnet tool required properties in package-types.md - Compact troubleshooting table Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Move nuget-trusted-publishing from skills/ to src/dotnet/skills/ - Add eval.yaml with two scenarios: greenfield setup and API key migration - Skills are auto-discovered via plugin.json, no marketplace.json change needed Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ment The skill's phased process was too heavyweight for simple greenfield setups — the agent would spend turns on assessment and never create the workflow. Added fast-path guidance to combine phases for single-project repos, and strengthened Phase 2/4 to ensure key content (NuGet/login, id-token, local pack verification) always appears in the first response. Eval results improved from 2.2/5 (regression) to 4.2/5 (improvement). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

lewing · 2026-02-26T19:02:10Z

Evaluator Output

Run 1 (before fix — commit `87f5659`)

Skill	Scenario	Baseline	With Skill	Δ	Skills Loaded	Verdict
nuget-trusted-publishing	Set up trusted publishing for a new NuGet library	3.0/5	2.2/5	-0.8	✅ nuget-trusted-publishing; tools: skill, glob, stop_powershell	❌
nuget-trusted-publishing	Migrate existing workflow from API key to trusted publishing	2.0/5	5.0/5	+3.0	✅ nuget-trusted-publishing; tools: skill, powershell, view	✅

Run 2 (after fix — commit `33458a2`)

Skill	Scenario	Baseline	With Skill	Δ	Skills Loaded	Verdict
nuget-trusted-publishing	Set up trusted publishing for a new NuGet library	3.0/5	4.2/5	+1.2	✅ nuget-trusted-publishing; tools: skill, glob, task	✅
nuget-trusted-publishing	Migrate existing workflow from API key to trusted publishing	2.0/5	4.8/5	+2.8	✅ nuget-trusted-publishing; tools: skill	✅

Model: claude-opus-4.6 | Judge: claude-opus-4.6

The greenfield scenario was regressing (-0.8) because the skill's multi-phase process caused the agent to spend turns on assessment without ever creating the workflow. Added a fast-path for simple repos that combines phases into a single response, bringing it to +1.2. Both scenarios now pass.

lewing · 2026-02-26T19:07:56Z

Eval Results (Run 4 — Exe classification fix + shell-agnostic INVOKES)

Scenario	Baseline	With Skill	Δ	Verdict
Set up trusted publishing for a new NuGet library	2.8/5 ⏰ timeout	3.8/5	+1.0	✅
Set up NuGet publishing without mentioning trusted publishing	2.2/5	5.0/5	+2.8	✅
Migrate existing workflow from API key to trusted publishing	2.0/5	4.6/5	+2.6	✅

Model: claude-opus-4.6 | Judge: claude-opus-4.6

Changes in this run:

Fixed Exe package classification (OutputType=Exe with IsPackable=true → application package, not skipped)
Changed INVOKES from bash to shell (powershell or bash) for cross-platform compatibility

Previous eval runs

Run 3 — After Copilot review feedback (INVOKES + ToolCommandName)

Scenario	Baseline	With Skill	Δ	Verdict
Set up trusted publishing for a new NuGet library	3.0/5	4.4/5	+1.4	✅
Set up NuGet publishing without mentioning trusted publishing	2.0/5	4.6/5	+2.6	✅
Migrate existing workflow from API key to trusted publishing	1.8/5	4.6/5	+2.8	✅

Run 2 — After greenfield fix + no-keyword scenario added

Scenario	Baseline	With Skill	Δ	Verdict
Set up trusted publishing for a new NuGet library	3.0/5	4.2/5	+1.2	✅
Set up NuGet publishing without mentioning trusted publishing	2.0/5	4.6/5	+2.6	✅
Migrate existing workflow from API key to trusted publishing	1.8/5	4.8/5	+3.0	✅

Run 1 — Initial (greenfield regressed)

Scenario	Baseline	With Skill	Δ	Verdict
Set up trusted publishing for a new NuGet library	3.0/5	2.2/5	-0.8	❌
Migrate existing workflow from API key to trusted publishing	1.8/5	4.8/5	+3.0	✅

…word Tests that the skill activates when the user asks about secure keyless NuGet publishing without explicitly mentioning trusted publishing or OIDC. Scores +2.6 improvement over baseline. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Change INVOKES from 'powershell' to 'bash' (workflow runs on ubuntu) - Mark ToolCommandName as optional (defaults to assembly name), matching package-types.md reference Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Exe projects with IsPackable=true can be published as NuGet packages (application packages), not just tools - Changed INVOKES from 'bash' to 'shell (powershell or bash)' for cross-platform compatibility Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

lewing · 2026-02-28T05:23:14Z

@jeffschwMSFT next steps?

jeffschwMSFT · 2026-02-28T12:57:05Z

@jeffschwMSFT next steps?

code review from the area owner (nuget?)

lewing · 2026-02-28T18:17:22Z

@kartheekp-ms can you review or point me to someone who can?

lewing · 2026-02-28T18:36:20Z

For reference, I've set up trusted publishing multiple times recently, including using this skill to do it.

Lanaparezanin · 2026-03-04T00:53:46Z

+
+2. Guide the user to create the trusted publishing policy:
+   > Go to [**nuget.org/account/trustedpublishing**](https://www.nuget.org/account/trustedpublishing) → **Add policy**
+   >


Please add package owner and policy name

I can do this but the form requires these and owner is filled by default. The text here is to suggest the specific values that augment the form not replace it

lewing · 2026-03-04T03:05:45Z

+
+2. Guide the user to create the trusted publishing policy:
+   > Go to [**nuget.org/account/trustedpublishing**](https://www.nuget.org/account/trustedpublishing) → **Add policy**
+   >


I can do this but the form requires these and owner is filled by default. The text here is to suggest the specific values that augment the form not replace it

Knowledge-driven skill for setting up NuGet trusted publishing (OIDC) on GitHub Actions repos, replacing long-lived API keys with short-lived tokens. Replaces #34 which could not be reopened after history rewrite.

* Add nuget-trusted-publishing skill Knowledge-driven skill for setting up NuGet trusted publishing (OIDC) on GitHub Actions repos, replacing long-lived API keys with short-lived tokens. Replaces #34 which could not be reopened after history rewrite. * Address review: move to plugins/tests layout, fix phase sequencing, add CODEOWNERS - Move skill from src/dotnet/skills/ to plugins/dotnet/skills/nuget-trusted-publishing/ - Move eval from src/dotnet/tests/ to tests/dotnet/nuget-trusted-publishing/ - Fix Phase 3/4 sequencing conflict: clarify that drafting the workflow is OK before policy confirmation, but publishing/removing secrets should wait - Add CODEOWNERS entry for nuget-trusted-publishing Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…noted xUnit, fixed MSTest example

lewing requested a review from Copilot February 18, 2026 00:51

Copilot started reviewing on behalf of lewing February 18, 2026 00:51 View session

Copilot AI reviewed Feb 18, 2026

View reviewed changes

lewing force-pushed the add-nuget-trusted-publishing branch 3 times, most recently from c28e28f to 87f5659 Compare February 23, 2026 23:38

lewing requested a review from Copilot February 24, 2026 00:20

Copilot started reviewing on behalf of lewing February 24, 2026 00:20 View session

Copilot AI reviewed Feb 24, 2026

View reviewed changes

Comment thread src/dotnet/skills/nuget-trusted-publishing/SKILL.md Outdated

jeffschwMSFT requested a review from kartheekp-ms February 24, 2026 22:12

jeffschwMSFT reviewed Feb 24, 2026

View reviewed changes

lewing and others added 4 commits February 26, 2026 11:53

lewing force-pushed the add-nuget-trusted-publishing branch from 87f5659 to 33458a2 Compare February 26, 2026 19:01

lewing requested review from Copilot and jeffschwMSFT February 26, 2026 19:52

Copilot started reviewing on behalf of lewing February 26, 2026 19:55 View session

Copilot AI reviewed Feb 26, 2026

View reviewed changes

Comment thread src/dotnet/skills/nuget-trusted-publishing/SKILL.md

Comment thread src/dotnet/skills/nuget-trusted-publishing/SKILL.md Outdated

Comment thread src/dotnet/skills/nuget-trusted-publishing/SKILL.md

Comment thread src/dotnet/skills/nuget-trusted-publishing/SKILL.md

lewing and others added 2 commits February 26, 2026 15:37

jeffschwMSFT added the area-nuget label Mar 2, 2026

Lanaparezanin reviewed Mar 3, 2026

View reviewed changes

Comment thread src/dotnet/skills/nuget-trusted-publishing/SKILL.md

Lanaparezanin reviewed Mar 3, 2026

View reviewed changes

Comment thread src/dotnet/skills/nuget-trusted-publishing/SKILL.md

Lanaparezanin reviewed Mar 4, 2026

View reviewed changes

Lanaparezanin suggested changes Mar 4, 2026

View reviewed changes

lewing commented Mar 4, 2026

View reviewed changes

lewing closed this Mar 4, 2026

lewing mentioned this pull request Mar 4, 2026

Add nuget-trusted-publishing skill #210

Merged

github-actions Bot mentioned this pull request Jun 4, 2026

Add JSON output for skill-validator check #601

Merged

moesac0970 pushed a commit to moesac0970/skills that referenced this pull request Jul 4, 2026

task(dotnet#34): keep dotnet-experimental/exp-test-maintainability - …

eafcadd

…noted xUnit, fixed MSTest example

Uh oh!

Conversation

lewing commented Feb 17, 2026