Fix trusted publishing: match environment claim to nuget.org policy - #28
Merged
Conversation
The nuget.org trusted publishing policy was created with Environment set to "production", which means the OIDC token issued to the job must carry a matching environment claim. Without an `environment:` key on the job, GitHub doesn't include that claim, so nuget.org's token exchange fails with 401 "No matching trust policy owned by user" even with a correct NUGET_USER value. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
environment: productionto thepublish-packagejob inpublish-pipeline.yml.Why
The nuget.org trusted publishing policy for this repo was created with Environment:
production. Per nuget.org's docs, when a policy specifies an environment, the GitHub Actions OIDC token must carry a matching environment claim, which only happens if the job declaresenvironment: <name>. Without it, the token exchange atnuget.org/api/v2/tokenfails with a 401 — surfaced as "No matching trust policy owned by user '***' was found" — even whenNUGET_USERis otherwise correct.Also worth checking
The 401 error text specifically says to use "the username of the policy creator, not the policy owner."
OpenLogics(the package/org owner) andSandounwere both tried forNUGET_USERand failed — that secret needs to be the exact nuget.org account username of whoever created the policy, visible at https://www.nuget.org/account (top-right profile), not the org name or a guessed handle. This PR doesn't change that secret's value — worth re-verifying it once this environment fix is in.Test plan
NUGET_USERsecret is set to the exact nuget.org profile username of the policy creator.publish-pipeline.ymlvia workflow_dispatch and confirm the NuGet.org push now succeeds.🤖 Generated with Claude Code