From e2563a06026277ebd84f5bdafcff977071803007 Mon Sep 17 00:00:00 2001
From: Rafal Maciag <max.maciag@rocketwelder.com>
Date: Sat, 24 Oct 2026 18:06:53 +0000
Subject: [PATCH] ci: nuget.org push through Trusted Publishing (NuGet/login
 OIDC) instead of the NUGET_API_KEY secret

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014wH5aL3TZhJNvLqa8YTku8
---
 .github/workflows/publish-nuget.yml | 13 ++++++++++---
 .github/workflows/release.yml       |  3 +++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish-nuget.yml b/.github/workflows/publish-nuget.yml
index ad3b053..92efaa8 100644
--- a/.github/workflows/publish-nuget.yml
+++ b/.github/workflows/publish-nuget.yml
@@ -21,6 +21,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write   # Trusted Publishing: GitHub mints an OIDC token, nuget.org swaps it for a 1-hour key
 
 jobs:
   publish:
@@ -112,15 +113,21 @@ jobs:
       working-directory: ./Sources/ModelingEvolution.Drawing
       run: dotnet pack --configuration Release --no-build --output ./nupkg /p:PackageVersion=${{ steps.version.outputs.version }}
     
+    # nuget.org Trusted Publishing: no long-lived key. The policy on nuget.org names this repo and this
+    # workflow file; NUGET_USER is the nuget.org profile name that owns the package (not an e-mail).
+    - name: NuGet login (OIDC → temporary API key)
+      id: nuget_login
+      uses: NuGet/login@v1
+      with:
+        user: ${{ secrets.NUGET_USER }}
+
     - name: Push to NuGet
       working-directory: ./Sources/ModelingEvolution.Drawing
       run: |
         dotnet nuget push ./nupkg/ModelingEvolution.Drawing.*.nupkg \
-          --api-key ${{ secrets.NUGET_API_KEY }} \
+          --api-key ${{ steps.nuget_login.outputs.NUGET_API_KEY }} \
           --source https://api.nuget.org/v3/index.json \
           --skip-duplicate
-      env:
-        NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
 
     - name: Publish to ModelingEvolution NuGet
       working-directory: ./Sources/ModelingEvolution.Drawing
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b889132..5d29e96 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -190,6 +190,9 @@ jobs:
   publish:
     needs: tag
     if: needs.tag.outputs.skip != 'true'
+    permissions:
+      contents: read
+      id-token: write   # the reusable workflow needs the OIDC token for nuget.org Trusted Publishing
     uses: ./.github/workflows/publish-nuget.yml
     with:
       version: ${{ needs.tag.outputs.version }}