nuget-trusted-publishing

Automate NuGet trusted publishing setup with OIDC on GitHub Actions.

5.1k|377|Updated Feb 3, 2026

Search Tags:#automation #publishing #security #github actions #nuget #oidc

Ready to run

npx skills add https://github.com/dotnet/skills --skill nuget-trusted-publishing

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: nuget-trusted-publishing
Source: https://github.com/dotnet/skills/tree/main/plugins/dotnet/skills/nuget-trusted-publishing
Command: npx skills add https://github.com/dotnet/skills --skill nuget-trusted-publishing

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill replaces long-lived NuGet API keys with secure, short-lived OIDC tokens, significantly enhancing the security of your NuGet package publishing process on GitHub Actions.

Core Features & Use Cases

OIDC Integration: Sets up GitHub Actions to use OIDC for authenticating with nuget.org.
Automated Workflow Setup: Guides users through creating or modifying GitHub Actions workflows for trusted publishing.
Package Type Validation: Assesses project files to ensure correct package metadata for libraries, tools, MCP servers, and templates.
Use Case: Securely publish your .NET library to nuget.org without managing or rotating API keys, by leveraging GitHub Actions OIDC.

Quick Start

Use the nuget-trusted-publishing skill to set up OIDC for publishing my-package.csproj to nuget.org.

Frequently Asked Questions about nuget-trusted-publishing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I publish NuGet packages without managing API keys?▼

You can publish NuGet packages without API keys by setting up OIDC trusted publishing on GitHub Actions, which replaces long-lived credentials with secure, short-lived tokens. This Skill automates that exact workflow configuration.

What is OIDC trusted publishing for NuGet and how does it work?▼

OIDC trusted publishing for NuGet is a security mechanism where GitHub Actions authenticates with nuget.org using short-lived OIDC tokens instead of static API keys. This Skill configures the required nuget.org policies and workflow files to automate the process.

Can I use GitHub Actions OIDC to publish different types of .NET packages?▼

Yes, GitHub Actions OIDC supports publishing various .NET package types. This Skill validates project files and configures workflows for libraries, dotnet tools, MCP servers, and templates to ensure correct metadata and secure keyless publishing.

What do I need to set up before configuring OIDC publishing for my .NET project?▼

Before configuring OIDC publishing, you need a packable .NET project with valid structure and metadata. This Skill assesses your project files, validates the package configuration, and then modifies or creates the necessary GitHub Actions workflows.

Why should I switch from static NuGet API keys to OIDC tokens?▼

Switching from static NuGet API keys to OIDC tokens significantly enhances security by eliminating the need to manage or rotate credentials. This Skill automates the transition to trusted publishing, ensuring your GitHub Actions workflows use short-lived authentication.