From d0020ee13e3290af8f2f2a256784d615999bbaf4 Mon Sep 17 00:00:00 2001 From: Chirag Aggarwal Date: Tue, 6 Oct 2026 20:23:00 +0100 Subject: [PATCH 1/2] ci: publish to NuGet with trusted publishing The NUGET_TOKEN API key expired, so 8.1.0 failed to publish with 403. NuGet/login exchanges the job's GitHub OIDC token for a one-hour API key, so no long-lived key is stored. --- .github/workflows/publish.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 111cb3d4..924739b9 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -7,6 +7,9 @@ jobs: publish: name: Release build and publish runs-on: ubuntu-latest + permissions: + contents: read + id-token: write # Exchanged for a short-lived NuGet API key (trusted publishing) steps: - name: Check out code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -24,5 +27,11 @@ jobs: dotnet build -c Release dotnet pack -c Release + - name: NuGet login + id: login + uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0 + with: + user: ${{ secrets.NUGET_USER }} + - name: Publish nuget - run: dotnet nuget push ./Appwrite/bin/Release/*.nupkg --api-key ${{ secrets.NUGET_TOKEN }} --source https://api.nuget.org/v3/index.json + run: dotnet nuget push ./Appwrite/bin/Release/*.nupkg --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json From d9d1db02d17c6a4b9e2cfb345320f7a254b2b233 Mon Sep 17 00:00:00 2001 From: Chirag Aggarwal Date: Tue, 6 Oct 2026 20:27:41 +0100 Subject: [PATCH 2/2] ci: read the NuGet username from a repository variable It only names the nuget.org account the short-lived key is issued for and grants nothing on its own. --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 924739b9..26f2c624 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -31,7 +31,7 @@ jobs: id: login uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0 with: - user: ${{ secrets.NUGET_USER }} + user: ${{ vars.NUGET_USER }} - name: Publish nuget run: dotnet nuget push ./Appwrite/bin/Release/*.nupkg --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json