docs: record trusted publishing as configured - #30
Merged
Conversation
All three prerequisites now exist: the nuget.org policy, the NUGET_USER secret, and the nuget environment with a required reviewer. RELEASING.md still warned that none of it was set up. The policy's Environment field is set to nuget rather than left blank. Both work -- nuget.org only checks the environment claim when the policy supplies a filter -- but setting it narrows the policy so a token minted from any other environment is rejected. That makes environment: nuget load-bearing in the publish job: removing it would change the claim and the policy would stop matching. Said so explicitly, because the line looks like boilerplate. Also notes to leave Prevent self-review off. With a single reviewer it does not secure anything, it just makes publishing impossible.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All three prerequisites now exist — the nuget.org policy, the
NUGET_USERsecret, and thenugetenvironment withivanvydas required reviewer.RELEASING.mdstill warned that none of it was set up.On the Environment field
The policy's Environment is set to
nugetrather than left blank. Both work — nuget.org only checks the token'senvironmentclaim when the policy supplies a filter — but setting it narrows the policy so a token minted from any other environment is rejected.That makes
environment: nugetin the publish job load-bearing: removing it would change the token's claim and the policy would stop matching. The doc now says so, because that line otherwise reads as boilerplate someone could tidy away.Also
Notes to leave Prevent self-review off. With a single reviewer it secures nothing and just makes publishing impossible.