v1.0.35 - #95
Merged
Merged
Conversation
Replace the long-lived NUGET_API_KEY repository secret with OIDC-based Trusted Publishing, so no durable credential is stored in GitHub. - Grant the workflow `id-token: write` so GitHub can issue an OIDC token. - Add a `NuGet/login@v1` step immediately before the push. The temporary API key nuget.org returns is valid for one hour and single-use, so it is requested after build/test/pack rather than at the top of the job. - Feed the push from `steps.nuget-login.outputs.NUGET_API_KEY` and replace the old "secret not configured" guard with a checklist that points at the likely policy mismatch when the token exchange yields no key. The nuget.org policy is bound to this workflow's file name, so renaming publish-nuget.yml requires updating the policy as well. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ci(nuget): switch publishing to NuGet.org Trusted Publishing
Reviewer's GuideThis PR updates the NuGet publish GitHub Actions workflow to use NuGet.org Trusted Publishing via OIDC, replacing the static API key secret with a short-lived key obtained at runtime and adding more targeted diagnostics if the login fails. Sequence diagram for NuGet.org Trusted Publishing via OIDCsequenceDiagram
participant GitHubActions as GitHubActionsWorkflow
participant NuGetLogin as NuGet_login_action
participant NuGetOrg as NuGet_org
participant PublishStep as Publish_to_NuGet_org_step
GitHubActions->>NuGetLogin: execute NuGet/login@v1 with user NUGET_USER
NuGetLogin->>NuGetOrg: exchange OIDC id-token for short-lived API key
NuGetOrg-->>NuGetLogin: return NUGET_API_KEY (1 hour, single-use)
NuGetLogin-->>GitHubActions: set output NUGET_API_KEY
GitHubActions->>PublishStep: start publish step with env NUGET_API_KEY
PublishStep->>PublishStep: check NUGET_API_KEY is non-empty
PublishStep->>NuGetOrg: push packages using short-lived NUGET_API_KEY
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- Consider scoping
id-token: writeto just thebuild-and-publishjob instead of the entire workflow to minimize the blast radius of OIDC permissions. - You may want to fail fast at the workflow level with
if: steps.nuget-login.outputs.NUGET_API_KEY == ''on the publish step rather than relying only on the shell check inside the script.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider scoping `id-token: write` to just the `build-and-publish` job instead of the entire workflow to minimize the blast radius of OIDC permissions.
- You may want to fail fast at the workflow level with `if: steps.nuget-login.outputs.NUGET_API_KEY == ''` on the publish step rather than relying only on the shell check inside the script.
## Individual Comments
### Comment 1
<location path=".github/workflows/publish-nuget.yml" line_range="239" />
<code_context>
+ echo "Checklist:"
+ echo " - NUGET_USER secret must be your nuget.org profile name (not e-mail)"
+ echo " - nuget.org Trusted Publishing policy must match:"
+ echo " owner=${{ github.repository_owner }}, repo=${{ github.event.repository.name }}, workflow=publish-nuget.yml"
+ echo " - Job must have 'id-token: write' permission"
exit 1
</code_context>
<issue_to_address>
**suggestion:** Avoid hard‑coding the workflow file name and prefer `github.workflow`/`github.repository` for the diagnostic message.
This checklist line hard-codes `workflow=publish-nuget.yml` and relies on `github.event.repository.name`, which isn’t available for all event types and could break if triggers change. Using `workflow=${{ github.workflow }}` and `repo=${{ github.repository }}` keeps the message accurate and robust if the workflow file is renamed or the event type changes, without requiring manual updates to the text.
```suggestion
echo " owner=${{ github.repository_owner }}, repo=${{ github.repository }}, workflow=${{ github.workflow }}"
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| echo "Checklist:" | ||
| echo " - NUGET_USER secret must be your nuget.org profile name (not e-mail)" | ||
| echo " - nuget.org Trusted Publishing policy must match:" | ||
| echo " owner=${{ github.repository_owner }}, repo=${{ github.event.repository.name }}, workflow=publish-nuget.yml" |
There was a problem hiding this comment.
suggestion: Avoid hard‑coding the workflow file name and prefer github.workflow/github.repository for the diagnostic message.
This checklist line hard-codes workflow=publish-nuget.yml and relies on github.event.repository.name, which isn’t available for all event types and could break if triggers change. Using workflow=${{ github.workflow }} and repo=${{ github.repository }} keeps the message accurate and robust if the workflow file is renamed or the event type changes, without requiring manual updates to the text.
Suggested change
| echo " owner=${{ github.repository_owner }}, repo=${{ github.event.repository.name }}, workflow=publish-nuget.yml" | |
| echo " owner=${{ github.repository_owner }}, repo=${{ github.repository }}, workflow=${{ github.workflow }}" |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
Adopt NuGet.org Trusted Publishing via GitHub OIDC for the NuGet publish workflow.
CI: