From 43f3508fcea7fcfd05897b3b14460a7b3d17e00c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20Wei=C3=9F?= <sandounde@gmail.com>
Date: Sat, 25 Jul 2026 21:07:59 +0200
Subject: [PATCH] Use NuGet trusted publishing (OIDC) for nuget.org push

Replaces the long-lived NUGET_TOKEN secret with a short-lived API key
obtained via GitHub Actions OIDC through the NuGet/login action, per
https://learn.microsoft.com/en-us/nuget/nuget-org/trusted-publishing.
The GitHub Packages push is unaffected and still uses GITHUB_TOKEN.

Requires a NUGET_USER repo secret (nuget.org username) and a Trusted
Publishing policy configured on nuget.org for this repo/workflow file.
The NUGET_TOKEN secret can be removed once this is verified working.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/publish-pipeline.yml | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish-pipeline.yml b/.github/workflows/publish-pipeline.yml
index 07246d7..2064ae3 100644
--- a/.github/workflows/publish-pipeline.yml
+++ b/.github/workflows/publish-pipeline.yml
@@ -144,13 +144,23 @@ jobs:
       - name: Pack as ${{ github.event.inputs.version_tag }}${{ env.prerelease_append }}
         run: dotnet pack "MewtocolNet" -c:Release
 
-      - name: Publish as ${{ github.event.inputs.version_tag }}${{ env.prerelease_append }}
-        run: | 
+      - name: Publish to GitHub Packages as ${{ github.event.inputs.version_tag }}${{ env.prerelease_append }}
+        run: |
             cd '${{ github.workspace }}/Builds/MewtocolNet'
             ls -l
             dotnet nuget push "*.nupkg" --skip-duplicate --api-key ${{ secrets.GITHUB_TOKEN }} --source "https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json"
-            dotnet nuget push "*.nupkg" --skip-duplicate --api-key ${{ secrets.NUGET_TOKEN }} --source "https://api.nuget.org/v3/index.json"
-        
+
+      - name: NuGet login (OIDC trusted publishing)
+        uses: NuGet/login@v1
+        id: nuget_login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
+      - name: Publish to NuGet.org as ${{ github.event.inputs.version_tag }}${{ env.prerelease_append }}
+        run: |
+            cd '${{ github.workspace }}/Builds/MewtocolNet'
+            dotnet nuget push "*.nupkg" --skip-duplicate --api-key ${{ steps.nuget_login.outputs.NUGET_API_KEY }} --source "https://api.nuget.org/v3/index.json"
+
       - name: 'Create Release v${{ github.event.inputs.version_tag }}${{ env.prerelease_append }}'
         id: create_release
         uses: actions/create-release@v1