ci: adopt NuGet trusted publishing - #530
Merged
Merged
Conversation
Bind the NuGet publishing job to the GitHub production environment, request OIDC id-token permissions, and exchange credentials through NuGet/login instead of repository API key secrets. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
JerrettDavis
enabled auto-merge (squash)
September 3, 2026 17:50
Contributor
Dependency ReviewThe following issues were found:
License Issues.github/workflows/ci.yml
OpenSSF Scorecard
Scanned Files
|
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The current workflow can still create tags/releases while silently skipping NuGet.org publishing if credentials aren’t issued, which can result in incomplete releases.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates the CI release workflow to publish NuGet packages via OIDC-based Trusted Publishing instead of using a long-lived NuGet API key, aligning releases with GitHub Environments for stronger controls.
Changes:
- Bind the
releasejob to theproductionenvironment. - Add
id-token: writepermission to enable OIDC token exchange. - Replace
secrets.NUGET_API_KEYusage withNuGet/login@v1and its temporaryNUGET_API_KEYoutput.
File summaries
| File | Description |
|---|---|
.github/workflows/ci.yml |
Updates the release job to use GitHub Environment + OIDC (NuGet/login@v1) for NuGet.org publishing. |
Review details
Suppressed comments (1)
.github/workflows/ci.yml:312
- If
NuGet/login@v1does not issue a token (e.g., trusted publishing not fully configured yet), this job will still succeed and create a tag/GitHub Release while skipping the NuGet.org publish. For thepush-to-mainrelease job, it’s safer to fail fast so you don’t ship a release without the NuGet package.
run: |
if [ -n "$NUGET_API_KEY" ]; then
dotnet nuget push ./artifacts/*.nupkg \
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
140
to
+147
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 90 | ||
| environment: production | ||
| permissions: | ||
| contents: write | ||
| packages: write | ||
| id-token: write |
Contributor
Code Coverage |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #530 +/- ##
=========================================
Coverage 97.44% 97.44%
=========================================
Files 611 611
Lines 49926 49926
Branches 3230 34 -3196
=========================================
+ Hits 48649 48650 +1
+ Misses 1277 1276 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
Test Results 12 files 12 suites 12m 1s ⏱️ Results for commit e70cd6c. |
Contributor
🔍 PR Validation ResultsVersion: `` ✅ Validation Steps
📊 ArtifactsDry-run artifacts have been uploaded and will be available for 7 days. This comment was automatically generated by the PR validation workflow. |
This was referenced Sep 7, 2026
Merged
This was referenced Sep 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
productionGitHub environmentid-token: writewhere the NuGet publish job runsNuGet/login@v1OIDC-based temporary credentialsReal Behavior Proof
environment: production,uses: NuGet/login@v1, andid-token: write.