SemianiakaVY/elsa-core
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity

feat: Implement OIDC Trusted Publishing for NuGet

Browse source 
This enhances security by configuring the NuGet publishing workflow to use GitHub OIDC Trusted Publishing. This mechanism exchanges a GitHub OIDC token for a temporary nuget.org API key, eliminating the need for a long-lived API key secret.
This commit is contained in:
Sipke Schoorstra 2026-08-18 00:10:22 +02:00
parent b0ab630a34
commit f6c35cf1eb
No known key found for this signature in database
GPG key ID: 5C10502B28A4268F
1 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
.github/workflows/packages.yml vendored
View file

@ -342,14 +342,27 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
timeout-minutes: 20 timeout-minutes: 20
if: ${{ github.event.action == 'published' }} if: ${{ github.event.action == 'published' }}
permissions:
contents: read
id-token: write # Required: lets this job request the OIDC token that nuget.org exchanges for a temporary API key.
steps: steps:
- name: Download Packages - name: Download Packages
uses: actions/download-artifact@v4.1.7 uses: actions/download-artifact@v4.1.7
with: with:
name: elsa-nuget-packages name: elsa-nuget-packages
# Exchanges a GitHub OIDC token for a temporary nuget.org API key (valid 1 hour).
# Requires a Trusted Publishing policy on nuget.org matching:
# Repository Owner: elsa-workflows | Repository: elsa-core | Workflow File: packages.yml
# Keep this step immediately before the push so the key cannot expire in between.
- name: NuGet login (OIDC)
uses: NuGet/login@v1
id: nuget_login
with:
user: ${{ secrets.NUGET_USER }} # nuget.org username (profile name), not an email address.
- name: Publish to nuget.org - name: Publish to nuget.org
run: dotnet nuget push *.nupkg -k "${{ secrets.NUGET_API_KEY }}" -s ${{ env.nuget_feed_source }} --skip-duplicate run: dotnet nuget push *.nupkg --api-key ${{ steps.nuget_login.outputs.NUGET_API_KEY }} --source ${{ env.nuget_feed_source }} --skip-duplicate
deploy_coverage: deploy_coverage:
name: Deploy coverage to GitHub Pages name: Deploy coverage to GitHub Pages