From 4105744a3bf5c04d7742392c80f5eecdae6832f9 Mon Sep 17 00:00:00 2001
From: ahall <ahall@cloudflare.com>
Date: Mon, 6 Jul 2026 10:36:55 +0100
Subject: [PATCH] build: enable NuGet trusted publishing for release workflows
 (#486)

Switch the NuGet.org release step in build-library.yml and
build-template.yml from the long-lived NUGET_PACKAGE_PUSH_TOKEN
API key to NuGet Trusted Publishing via OIDC.

- Add id-token: write / contents: read permissions to the release job
- Add a NuGet/login@v1 step to exchange OIDC for a short-lived API key
- Use the login step's NUGET_API_KEY output when pushing packages
---
 .github/workflows/build-library.yml  | 11 ++++++++++-
 .github/workflows/build-template.yml | 11 ++++++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-library.yml b/.github/workflows/build-library.yml
index 4d24b44..a74d367 100644
--- a/.github/workflows/build-library.yml
+++ b/.github/workflows/build-library.yml
@@ -209,6 +209,9 @@ jobs:
     needs: [ sign ]
     environment: nuget-release-gate
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - name: Setup .NET
@@ -222,10 +225,16 @@ jobs:
           name: nuget-signed
           path: ${{ github.workspace }}/packages
 
+      - name: NuGet login (OIDC)
+        id: login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
       - name: Push signed packages to NuGet.org
         run: >
           dotnet nuget push
           ${{ github.workspace }}/packages/**/*.nupkg
           --source https://api.nuget.org/v3/index.json
-          --api-key ${{ secrets.NUGET_PACKAGE_PUSH_TOKEN }}
+          --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
           --skip-duplicate
diff --git a/.github/workflows/build-template.yml b/.github/workflows/build-template.yml
index 89a8ab8..64e65ed 100644
--- a/.github/workflows/build-template.yml
+++ b/.github/workflows/build-template.yml
@@ -153,6 +153,9 @@ jobs:
     needs: [ sign ]
     environment: nuget-release-gate
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - name: Setup .NET
@@ -166,10 +169,16 @@ jobs:
           name: nuget-signed
           path: ${{ github.workspace }}/packages
 
+      - name: NuGet login (OIDC)
+        id: login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
       - name: Push signed packages to NuGet.org
         run: >
           dotnet nuget push
           ${{ github.workspace }}/packages/**/*.nupkg
           --source https://api.nuget.org/v3/index.json
-          --api-key ${{ secrets.NUGET_PACKAGE_PUSH_TOKEN }}
+          --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
           --skip-duplicate