[rafalmaciag]

nuget.org is moving long-lived API keys out; the publish path now logs in with NuGet/login@v1 (GitHub OIDC token → 1-hour API key) and pushes with that key. The internal-feed push (NUGET_API_KEY_ME) is unchanged.

Changes

• publish-nuget.yml: id-token: write; a NuGet login step before Push to NuGet; the push uses steps.nuget_login.outputs.NUGET_API_KEY. The NUGET_API_KEY secret is no longer read anywhere.
• release.yml: the publish job (which uses: the reusable workflow) grants id-token: write to it.

Owner setup on nuget.org (before this merges; otherwise the next release fails at the login step with 401 "No matching trust policy")

1. nuget.org → your profile menu → Trusted Publishing → Add policy, owner = the account/organisation that owns ModelingEvolution.Drawing:
   • Repository Owner modelingevolution, Repository drawing, Workflow File publish-nuget.yml, Environment empty.
   • A second policy identical except Workflow File release.yml: releases run publish-nuget.yml as a reusable workflow called from release.yml, and nuget.org's docs do not say which of the two file names the token is matched on. Previews (tag pushes) run publish-nuget.yml directly. Both policies are harmless if one is unused.
2. Repository secret NUGET_USER = the nuget.org profile name of that account (not the e-mail): gh secret set NUGET_USER -R modelingevolution/drawing.
3. The policy becomes permanently active on the first successful login. Drawing is public, so there is no 7-day pending window.

After this merges, NUGET_API_KEY can be deleted from the repo secrets.

🤖 Generated with Claude Code

https://claude.ai/code/session_014wH5aL3TZhJNvLqa8YTku8