feat: support nuget.org Trusted Publishing via GitHub Actions OIDC by Copilot · Pull Request #4884 · GitTools/GitVersion

Copilot · 2026-03-18T18:32:49Z

Replaces long-lived NuGet API key dependency with OIDC-based Trusted Publishing, retaining the static key as a fallback.

Changes

build/publish/Tasks/PublishNuget.cs — On tagged releases, attempts OIDC token exchange with nuget.org before falling back to NUGET_API_KEY:
```
// Prefer Trusted Publishing via OIDC token exchange
var apiKey = await GetNugetApiKey(context);
// Fall back to static API key when OIDC is not available
if (string.IsNullOrEmpty(apiKey))
    apiKey = context.Credentials?.Nuget?.ApiKey;
```
Requests a GitHub OIDC token scoped to https://www.nuget.org, then POSTs to https://www.nuget.org/api/v2/token to exchange it for a short-lived API key.
.github/workflows/_publish.yml — Adds id-token: write permission to the publish job; retains nuget-creds step and NUGET_API_KEY env var for the fallback path.
CONTRIBUTING.md — Rewrites the Trusted Publishing setup section: one entry per repository/workflow covers all packages; includes exact field values and navigation path for nuget.org setup.

Original prompt

This section details on the original issue you should resolve

<issue_title>Support nuget.org Trusted Publishing</issue_title>
<issue_description>## Objective
Enable secure, maintainable package publishing by supporting nuget.org Trusted Publishing for this repository.

Why

NuGet Trusted Publishing removes long-lived API key dependence and aligns publishing with short-lived identity-based trust.

In Scope

Define repository-level support for publishing GitVersion packages via nuget.org Trusted Publishing.

Ensure release/publish workflows can use trusted identity to publish packages.

Maintain release reliability while improving credential security posture.

Document maintainers' expected operational flow for trusted publishing.

Out of Scope

Introducing new package feeds or changing package naming/versioning strategy.

Broad CI/CD redesign unrelated to package publishing authentication.

Done When

Package publishing to nuget.org is available through Trusted Publishing.

No long-lived nuget.org API key is required for normal publish operations.

Maintainers have clear documentation for setup/verification and troubleshooting.

Reference

https://learn.microsoft.com/en-us/nuget/nuget-org/trusted-publishing
</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes Support nuget.org Trusted Publishing #4883

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

- Wire up OIDC token exchange in PublishNuget.cs as primary publish path - Add catch-all Exception handler and use Warning for non-fatal OIDC errors - Add id-token: write permission to _publish.yml publish job - Remove 1Password NuGet creds step and NUGET_API_KEY env var - Document Trusted Publishing in CONTRIBUTING.md Co-authored-by: arturcic <[email protected]>

arturcic · 2026-03-18T18:52:42Z

.github/workflows/_publish.yml

        run: dotnet run/publish.dll --target=Publish${{ matrix.taskName }}
        env:
          GITHUB_TOKEN: ${{ github.token }}
-          NUGET_API_KEY: ${{ steps.nuget-creds.outputs.nuget_api_key }}


@copilot if you remove this here, that means the fallback solution won't work

Restored the nuget-creds step and NUGET_API_KEY env var in commit 22980a2. The fallback path in PublishNuget.cs reads NUGET_API_KEY from the environment, so both are needed for the fallback to work when OIDC is unavailable.

Without NUGET_API_KEY in the env, the fallback from OIDC to static API key in PublishNuget.cs was dead code. Restore the nuget-creds step and the env var so the fallback path is functional. Co-authored-by: arturcic <[email protected]>

…IBUTING.md Add step-by-step setup guide covering: - Enumerated list of the three packages that need configuration - Numbered steps to navigate nuget.org package settings - Lookup table with exact field values (owner, repo, workflow file, environment) - Warning note on exact-match OIDC claim requirement - Updated troubleshooting to mention 1Password fallback explicitly Co-authored-by: arturcic <[email protected]>

… not per package Co-authored-by: arturcic <[email protected]>

Copilot

Pull request overview

Updates the repository’s NuGet publishing guidance and pipeline to support nuget.org Trusted Publishing (OIDC-based short-lived API keys), while retaining a static API key fallback path for environments where OIDC/token exchange is unavailable.

Changes:

Add OIDC-based NuGet API key retrieval (token exchange) with fallback to the configured static NuGet API key.
Grant the publish reusable workflow the id-token: write permission required for GitHub OIDC.
Rewrite CONTRIBUTING.md release documentation to describe one-time Trusted Publisher setup on nuget.org.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
build/publish/Tasks/PublishNuget.cs	Prefer OIDC token exchange for nuget.org publishing, falling back to a static API key if needed.
CONTRIBUTING.md	Document repository/workflow-level nuget.org Trusted Publishing setup and troubleshooting.
.github/workflows/_publish.yml	Add job permissions needed to request an OIDC token during publishing.

CONTRIBUTING.md

arturcic · 2026-03-18T19:19:58Z

build/publish/Tasks/PublishNuget.cs

+            // Prefer Trusted Publishing via OIDC token exchange (no long-lived API key required)
+            var apiKey = await GetNugetApiKey(context);
+
+            // Fall back to a static API key when OIDC is not available
+            if (string.IsNullOrEmpty(apiKey))
+            {
+                context.Information("OIDC token exchange unavailable; falling back to static NuGet API key.");
+                apiKey = context.Credentials?.Nuget?.ApiKey;
+            }


@copilot implement this

The OIDC token exchange with static API key fallback was already implemented in PublishNuget.cs. Updated the PR description in commit 12f1b78 to accurately reflect both the pipeline changes (PublishNuget.cs, _publish.yml) and the documentation updates.

The OIDC token exchange (with fallback to static NUGET_API_KEY) is implemented in build/publish/Tasks/PublishNuget.cs. Also added the missing using System.Text; import for Encoding.UTF8 in commit 12f1b78.

Co-authored-by: Copilot Autofix powered by AI <[email protected]>

arturcic · 2026-03-18T19:19:37Z

CONTRIBUTING.md

+   **Trusted Publishers**).
+3. Click **Add trusted publisher** and fill in the following fields:
+
+   | Field | Value |


@copilot format the table

Table columns are now aligned in commit 12f1b78.

arturcic · 2026-03-18T19:19:58Z

build/publish/Tasks/PublishNuget.cs

+            // Prefer Trusted Publishing via OIDC token exchange (no long-lived API key required)
+            var apiKey = await GetNugetApiKey(context);
+
+            // Fall back to a static API key when OIDC is not available
+            if (string.IsNullOrEmpty(apiKey))
+            {
+                context.Information("OIDC token exchange unavailable; falling back to static NuGet API key.");
+                apiKey = context.Credentials?.Nuget?.ApiKey;
+            }


@copilot implement this

…irective Co-authored-by: arturcic <[email protected]>

Co-authored-by: arturcic <[email protected]>

sonarqubecloud · 2026-03-18T19:43:06Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

mergify · 2026-03-18T21:57:31Z

Thank you @Copilot for your contribution!

Initial plan

c483a48

Copilot AI assigned Copilot and arturcic Mar 18, 2026

Copilot started work on behalf of arturcic March 18, 2026 18:32 View session

Copilot AI changed the title ~~[WIP] Enable nuget.org Trusted Publishing for package publishing~~ Support nuget.org Trusted Publishing Mar 18, 2026

Copilot AI requested a review from arturcic March 18, 2026 18:41

Copilot finished work on behalf of arturcic March 18, 2026 18:41

arturcic requested changes Mar 18, 2026

View reviewed changes

Copilot started work on behalf of arturcic March 18, 2026 18:52 View session

Copilot AI requested a review from arturcic March 18, 2026 18:54

Copilot finished work on behalf of arturcic March 18, 2026 18:54

Copilot started work on behalf of arturcic March 18, 2026 18:55 View session

Copilot finished work on behalf of arturcic March 18, 2026 18:57

Copilot started work on behalf of arturcic March 18, 2026 19:04 View session

docs: correct nuget.org Trusted Publishing setup - one-time per repo,…

a1bc95e

… not per package Co-authored-by: arturcic <[email protected]>

Copilot AI changed the title ~~Support nuget.org Trusted Publishing~~ docs: correct nuget.org Trusted Publishing setup instructions Mar 18, 2026

Copilot finished work on behalf of arturcic March 18, 2026 19:06

arturcic marked this pull request as ready for review March 18, 2026 19:11

Copilot AI review requested due to automatic review settings March 18, 2026 19:11

Copilot AI reviewed Mar 18, 2026

View reviewed changes

Apply suggestions from code review

494021c

Co-authored-by: Copilot Autofix powered by AI <[email protected]>

arturcic requested changes Mar 18, 2026

View reviewed changes

Copilot started work on behalf of arturcic March 18, 2026 19:22 View session

fix: format CONTRIBUTING.md table and add missing System.Text using d…

12f1b78

…irective Co-authored-by: arturcic <[email protected]>

Copilot AI changed the title ~~docs: correct nuget.org Trusted Publishing setup instructions~~ feat: support nuget.org Trusted Publishing with OIDC token exchange Mar 18, 2026

Copilot AI requested a review from arturcic March 18, 2026 19:26

Copilot finished work on behalf of arturcic March 18, 2026 19:26

Copilot started work on behalf of arturcic March 18, 2026 19:40 View session

fix: remove unnecessary System.Text using directive from PublishNuget.cs

b933173

Co-authored-by: arturcic <[email protected]>

Copilot AI changed the title ~~feat: support nuget.org Trusted Publishing with OIDC token exchange~~ feat: support nuget.org Trusted Publishing via GitHub Actions OIDC Mar 18, 2026

Copilot finished work on behalf of arturcic March 18, 2026 19:42

arturcic approved these changes Mar 18, 2026

View reviewed changes

arturcic merged commit 5d5aaa1 into main Mar 18, 2026
230 of 231 checks passed

arturcic deleted the copilot/support-nuget-org-trusted-publishing branch March 18, 2026 21:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: support nuget.org Trusted Publishing via GitHub Actions OIDC#4884

feat: support nuget.org Trusted Publishing via GitHub Actions OIDC#4884
arturcic merged 8 commits intomainfrom
copilot/support-nuget-org-trusted-publishing

Copilot AI commented Mar 18, 2026 •

edited

Loading

Uh oh!

arturcic Mar 18, 2026

Uh oh!

Copilot AI Mar 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

arturcic Mar 18, 2026

Uh oh!

Copilot AI Mar 18, 2026

Uh oh!

Copilot AI Mar 18, 2026

Uh oh!

arturcic Mar 18, 2026

Uh oh!

Copilot AI Mar 18, 2026

Uh oh!

arturcic Mar 18, 2026

Uh oh!

sonarqubecloud bot commented Mar 18, 2026

Uh oh!

Uh oh!

mergify bot commented Mar 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Why

In Scope

Out of Scope

Done When

Reference

Comments on the Issue (you are @copilot in this section)

Uh oh!

arturcic Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

arturcic Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

arturcic Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

arturcic Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Mar 18, 2026

Quality Gate passed

Uh oh!

Uh oh!

mergify bot commented Mar 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 18, 2026 •

edited

Loading