From 38fd98cf09717a13041caa99679a4f63ad4f3521 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20St=C3=BChmer?= <martin@stuehmer.net>
Date: Fri, 6 Nov 2026 16:15:48 +0100
Subject: [PATCH] feat(nuget): support Trusted Publishing via NuGet/login

Add optional NUGET_USER secret. When set, authenticate with a short-lived
OIDC-issued API key; otherwise fall back to the legacy NUGET_TOKEN.
Grant id-token: write on the publish workflows.
---
 .github/workflows/publish-nuget.yml           |  7 ++++++-
 .../workflows/step-dotnet-publish-nuget.yml   | 21 +++++++++++++++++--
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish-nuget.yml b/.github/workflows/publish-nuget.yml
index e06de4eb..542a4b44 100644
--- a/.github/workflows/publish-nuget.yml
+++ b/.github/workflows/publish-nuget.yml
@@ -22,7 +22,11 @@ on:
         description: "Name of the workflow to check for successful builds"
     secrets:
       NUGET_TOKEN:
-        required: true
+        required: false
+        description: "Legacy API key. Ignored when NUGET_USER is set (Trusted Publishing)."
+      NUGET_USER:
+        required: false
+        description: "nuget.org profile name for Trusted Publishing (OIDC)"
       WORKFLOW_PACKAGES:
         required: true
 
@@ -39,6 +43,7 @@ env:
 permissions:
   actions: read
   contents: write
+  id-token: write
   pull-requests: write
 
 jobs:
diff --git a/.github/workflows/step-dotnet-publish-nuget.yml b/.github/workflows/step-dotnet-publish-nuget.yml
index 6c4b8f1c..9d56aa5a 100644
--- a/.github/workflows/step-dotnet-publish-nuget.yml
+++ b/.github/workflows/step-dotnet-publish-nuget.yml
@@ -22,12 +22,17 @@ on:
         description: "Name of the workflow to check for successful builds"
     secrets:
       NUGET_TOKEN:
-        required: true
+        required: false
+        description: "Legacy API key. Ignored when NUGET_USER is set (Trusted Publishing)."
+      NUGET_USER:
+        required: false
+        description: "nuget.org profile name for Trusted Publishing (OIDC)"
       WORKFLOW_PACKAGES:
         required: true
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   nuget:
@@ -36,6 +41,9 @@ jobs:
 
     environment: ${{ inputs.environment }}
 
+    env:
+      NUGET_USER: ${{ secrets.NUGET_USER }}
+
     steps:
       - name: Download artifacts from `${{ inputs.workflowName }}` workflow
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
@@ -46,6 +54,15 @@ jobs:
           pattern: ${{ inputs.artifactPattern }}
           run-id: ${{ inputs.runId }}
 
+      - name: NuGet login (Trusted Publishing)
+        id: login
+        if: ${{ env.NUGET_USER != '' }}
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
+        with:
+          user: ${{ env.NUGET_USER }}
+
       - name: Publish NuGet Package
+        env:
+          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY || secrets.NUGET_TOKEN }}
         run: |
-          dotnet nuget push packages/**/*.nupkg -k ${{ secrets.NUGET_TOKEN }} -s https://api.nuget.org/v3/index.json --skip-duplicate
+          dotnet nuget push packages/**/*.nupkg -k "$NUGET_API_KEY" -s https://api.nuget.org/v3/index.json --skip-duplicate