From 7729c6cb8cec8dd519967d8b4ba4274fb7652d91 Mon Sep 17 00:00:00 2001
From: Mauro Servienti <mauro.servienti@gmail.com>
Date: Sun, 1 Nov 2026 17:19:11 +0100
Subject: [PATCH 1/2] Publish to NuGet.org with trusted publishing (#267)

Get a short-lived API key from NuGet.org through GitHub's OIDC token instead of using the long-lived NUGET_API_KEY secret.

(cherry picked from commit b9131270740444ba0bed63b4a1f4d9a1bc65cd04)
---
 .github/workflows/ci.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 99b54e7..81e6cf5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,6 +49,9 @@ jobs:
   release:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: checkout code
         uses: actions/checkout@v6.0.2
@@ -76,9 +79,15 @@ jobs:
           echo "Tag is pre-release"
           echo "Pushing package to Feedz.io"
           dotnet nuget push ./nugets/*.nupkg --source https://f.feedz.io/servicecomposer/pre-releases/nuget --api-key ${{ secrets.FEEDZ_API_KEY }}
+      - name: NuGet login
+        id: nuget-login
+        if: steps.check-tag-type.outputs.release-type == 'production'
+        uses: NuGet/login@v1.2.0
+        with:
+          user: ${{ secrets.NUGET_USER }}
       - name: Deploy release to NuGet
         if: steps.check-tag-type.outputs.release-type == 'production'
         run: |
           echo "Tag is production"
           echo "Pushing package to NuGet.org"
-          dotnet nuget push ./nugets/*.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_API_KEY }}
+          dotnet nuget push ./nugets/*.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }}

From cf7232818f3094ad62d8d3a9614605586e9231f5 Mon Sep 17 00:00:00 2001
From: Mauro Servienti <mauro.servienti@gmail.com>
Date: Sun, 1 Nov 2026 17:43:48 +0100
Subject: [PATCH 2/2] Publish releases for multi-digit version numbers (#269)

The tag filters only matched single-digit majors and stable patches, so tags such as 4.2.10 or 10.0.0 published nothing. The stable tag check was unanchored and unescaped, so a pre-release tag ending in three numbers, such as 1.0.0-alpha.1.2.3, would have been published to NuGet.org as stable.

(cherry picked from commit beb237e490afc3b4995a7aaccd11730c18e872ed)
---
 .github/workflows/ci.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 81e6cf5..7984820 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,8 +2,8 @@ name: CI
 on:
   push:
     tags:
-      - '[0-9].[0-9]+.[0-9]'
-      - '[0-9].[0-9]+.[0-9]+-*'
+      - '[0-9]+.[0-9]+.[0-9]+'
+      - '[0-9]+.[0-9]+.[0-9]+-*'
     branches:
       - master
       - release-*
@@ -68,7 +68,7 @@ jobs:
         id: check-tag-type
         if: github.ref_type == 'tag'
         run: |
-          if [[ ${{ github.ref_name }} =~ [0-9]+.[0-9]+.[0-9]+$ ]]; then
+          if [[ ${{ github.ref_name }} =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "release-type=production" >> $GITHUB_OUTPUT
           else
             echo "release-type=pre-release" >> $GITHUB_OUTPUT