Use nuget.org Trusted Publishing (OIDC) + add README badges - #7
Conversation
Authenticate the release workflow via nuget.org Trusted Publishing rather than a long-lived NUGET_API_KEY secret: - Add `id-token: write` and a `NuGet/login@v1` step that exchanges the GitHub OIDC token for a short-lived nuget.org key. The login step is skipped on dry runs, so dry runs never touch nuget.org. - Source the push key from the login step's output; drop the secret. - Update RELEASING.md (Trusted Publishing setup) and ROADMAP.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V1phdgDossB7htzxcbZTNF
- CI badge tracks the Build & test workflow on main. - NuGet badge uses shields' vpre so it shows the latest version including prereleases (the project ships alphas; a stable-only badge would read "no version" until a 1.0). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V1phdgDossB7htzxcbZTNF
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6ef44dfc82
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| (OIDC) — there is **no API key secret to manage**. On nuget.org (Account → Trusted Publishing), add a | ||
| policy matching this repository: | ||
|
|
||
| - **Package owner:** `tsharp` |
There was a problem hiding this comment.
Configuring the Trusted Publishing policy under tsharp widens this release credential beyond BettererNet: Microsoft’s policy ownership docs state that the policy applies to all packages owned by the selected owner, and the public tsharp profile currently owns unrelated packages such as MemoizR and PipeEx. In any non-dry release run, this repo can now mint a key with rights to those packages, whereas the previous setup explicitly asked for an API key scoped to BettererNet.*; use a BettererNet-only NuGet owner or add a protected GitHub environment and require it in the policy before removing the scoped key.
Useful? React with 👍 / 👎.
Trusted Publishing policies are owner-wide (a policy can push any package the owner holds), so bind real releases to a protected GitHub environment that the nuget.org policy can require. The release job joins `nuget-release` only on a real publish (tag push or dry_run=false); dry runs resolve to an empty environment name so packaging can still be verified on any branch. Documents creating the environment (restrict to v* tags, optional required reviewer) and adding it to the nuget.org policy in RELEASING.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V1phdgDossB7htzxcbZTNF
Two changes toward shipping
v0.1.0-alpha.1. Trusted Publishing (OIDC) for releases
Replaces the long-lived
NUGET_API_KEYsecret with nuget.org Trusted Publishing inrelease.yml:permissions: id-token: writeso the runner can request a GitHub OIDC token.NuGet/login@v1step (user: tsharp) exchanges that token for a short-lived nuget.org key. It's gated withif:so it's skipped on dry runs — dry runs never contact nuget.org.steps.login.outputs.NUGET_API_KEY. The explicit 13-package allow-list, dry-run gating, and--skip-duplicateare unchanged.RELEASING.md/ROADMAP.mdupdated: documents the trusted-publishing policy (ownertsharp, repotimonkrebs/BettererNet, workflowrelease.yml) instead of an API-key secret.Validation: dry-run on this branch passed green — run #4 — confirming the workflow parses on GitHub and still packs all 13 (login step correctly skipped). The OIDC exchange itself is only exercised on a real
v*tag publish.2. README badges
main).BettererNet.Cli, using shields'vpreso it shows prerelease versions (the project ships alphas). It'll read "no version" until the first publish, then light up.🤖 Generated with Claude Code
https://claude.ai/code/session_01V1phdgDossB7htzxcbZTNF
Generated by Claude Code