From d71c2dcc9219130a75d233a12c36a364d0e3bad4 Mon Sep 17 00:00:00 2001
From: John Korsnes <johnkors@gmail.com>
Date: Sun, 13 Sep 2026 14:06:06 +0200
Subject: [PATCH] Switch Release/PreRelease to NuGet trusted publishing (OIDC)

Replaces the long-lived NUGETORGAPIKEY secret with a short-lived
API key obtained via NuGet/login@v1, using GitHub Actions OIDC.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/PreRelease.yml |  9 ++++++++-
 .github/workflows/Release.yml    | 10 +++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/PreRelease.yml b/.github/workflows/PreRelease.yml
index 9515377..8ad0c73 100644
--- a/.github/workflows/PreRelease.yml
+++ b/.github/workflows/PreRelease.yml
@@ -6,6 +6,8 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
 
     steps:
       - uses: actions/checkout@v7
@@ -32,5 +34,10 @@ jobs:
           useConfigFile: true
       - name: Pack
         run: dotnet pack source /p:Version=${{ steps.gitversion.outputs.NuGetVersionV2 }}-${{ steps.gitversion.outputs.ShortSha }} /p:InformationalVersion=${{ steps.gitversion.outputs.informationalVersion }} /p:PackageReleaseNotes="https://github.com/$GITHUB_REPOSITORY/releases/tag/${{ steps.gitversion.outputs.NuGetVersionV2 }}" -o ./releases
+      - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: johnkors
       - name: Publish
-        run: dotnet nuget push ./releases/**/*.nupkg -k=${{ secrets.NUGETORGAPIKEY }} -s=nuget.org
+        run: dotnet nuget push ./releases/**/*.nupkg --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json
diff --git a/.github/workflows/Release.yml b/.github/workflows/Release.yml
index f376f0f..80b46dc 100644
--- a/.github/workflows/Release.yml
+++ b/.github/workflows/Release.yml
@@ -6,6 +6,9 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
 
     steps:
       - uses: actions/checkout@v7
@@ -32,8 +35,13 @@ jobs:
           useConfigFile: true
       - name: Pack
         run: dotnet pack source /p:Version=${{ steps.gitversion.outputs.majorMinorPatch }} /p:InformationalVersion=${{ steps.gitversion.outputs.informationalVersion }} /p:PackageReleaseNotes="https://github.com/$GITHUB_REPOSITORY/releases/tag/${{ steps.gitversion.outputs.majorMinorPatch }}" -o ./releases
+      - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: johnkors
       - name: Publish
-        run: dotnet nuget push ./releases/**/*.nupkg -k=${{ secrets.NUGETORGAPIKEY }} -s=nuget.org
+        run: dotnet nuget push ./releases/**/*.nupkg --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json
       - name: Generate CHANGELOG.md
         id: releasenotes
         run: |