ci: nuget.org Trusted Publishing (OIDC) replaces the NUGET_API_KEY secret

.github/workflows/publish-nuget.yml

@@ -21,6 +21,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write   # Trusted Publishing: GitHub mints an OIDC token, nuget.org swaps it for a 1-hour key
 
 jobs:
   publish:
@@ -112,15 +113,21 @@ jobs:
       working-directory: ./Sources/ModelingEvolution.Drawing
       run: dotnet pack --configuration Release --no-build --output ./nupkg /p:PackageVersion=${{ steps.version.outputs.version }}
 
+    # nuget.org Trusted Publishing: no long-lived key. The policy on nuget.org names this repo and this
+    # workflow file; NUGET_USER is the nuget.org profile name that owns the package (not an e-mail).
+    - name: NuGet login (OIDC → temporary API key)
+      id: nuget_login
+      uses: NuGet/login@v1
+      with:
+        user: ${{ secrets.NUGET_USER }}
+
     - name: Push to NuGet
       working-directory: ./Sources/ModelingEvolution.Drawing
       run: |
         dotnet nuget push ./nupkg/ModelingEvolution.Drawing.*.nupkg \
-          --api-key ${{ secrets.NUGET_API_KEY }} \
+          --api-key ${{ steps.nuget_login.outputs.NUGET_API_KEY }} \
           --source https://api.nuget.org/v3/index.json \
           --skip-duplicate
-      env:
-        NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
 
     - name: Publish to ModelingEvolution NuGet
       working-directory: ./Sources/ModelingEvolution.Drawing

.github/workflows/release.yml

@@ -190,6 +190,9 @@ jobs:
   publish:
     needs: tag
     if: needs.tag.outputs.skip != 'true'
+    permissions:
+      contents: read
+      id-token: write   # the reusable workflow needs the OIDC token for nuget.org Trusted Publishing
     uses: ./.github/workflows/publish-nuget.yml
     with:
       version: ${{ needs.tag.outputs.version }}