ci: publish with NuGet trusted publishing instead of a stored API key - #28
Merged
Conversation
GitHub mints a short-lived OIDC token, nuget.org verifies it against a policy naming this exact repository, workflow file and environment, and returns a key valid for one hour. Nothing long-lived is stored in the repository, so there is no key to leak, rotate, or scope too widely -- and a leaked key cannot be replayed from anywhere else, because the token only validates from this workflow. The exchange happens immediately before the push: the temporary key lasts an hour and each OIDC token buys exactly one key, so requesting it early enough to expire is a real failure mode. NuGet/login is pinned to a commit SHA like every other action here. Note that the v1 tag is annotated, so the tag object SHA is not the commit SHA -- pinned to the commit, 8d196754, which v1.2.0 also points at. RELEASING.md now walks through the three prerequisites step by step: the policy fields on nuget.org (workflow file name only, no path), the NUGET_USER secret holding the profile name rather than an email, and the environment whose required reviewer is both the approval gate and what the policy binds to.
ivanvyd
force-pushed
the
chore/trusted-publishing
branch
from
August 1, 2026 10:32
13c10fc to
7fb76c2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the long-lived
NUGET_API_KEYsecret with OIDC-based trusted publishing.GitHub mints a short-lived token, nuget.org verifies it against a policy naming this exact repository, workflow file and environment, and returns a key valid for one hour. Nothing long-lived is stored in the repo — there is no key to leak, rotate, or scope too widely, and a stolen token cannot be replayed from another workflow.
The exchange runs immediately before the push: the key lasts an hour and each OIDC token buys exactly one key, so requesting it too early is a real failure mode rather than a theoretical one.
NuGet/loginis pinned to a commit SHA like every other action here. Worth noting thev1tag is annotated, so the tag-object SHA (ebc737b) is not the commit SHA — pinned to the commit8d196754, whichv1.2.0also points at.Setup this requires (documented in RELEASING.md)
ivanvyd, repolakespeak, workflow filerelease.yml(name only, no path), environmentnuget.NUGET_USERsecret holding the nuget.org profile name, not an email.nugetenvironment with a required reviewer — which is both the approval gate and what the policy binds to.None of these exist yet; the workflow fails early with a clear message rather than half-publishing.