nuget-trusted-publishing

You can publish NuGet packages without API keys by setting up OIDC trusted publishing on GitHub Actions, which replaces long-lived credentials with secure, short-lived tokens. This Skill automates that exact workflow configuration.

OIDC trusted publishing for NuGet is a security mechanism where GitHub Actions authenticates with nuget.org using short-lived OIDC tokens instead of static API keys. This Skill configures the required nuget.org policies and workflow files to automate the process.

Yes, GitHub Actions OIDC supports publishing various .NET package types. This Skill validates project files and configures workflows for libraries, dotnet tools, MCP servers, and templates to ensure correct metadata and secure keyless publishing.

Before configuring OIDC publishing, you need a packable .NET project with valid structure and metadata. This Skill assesses your project files, validates the package configuration, and then modifies or creates the necessary GitHub Actions workflows.

Switching from static NuGet API keys to OIDC tokens significantly enhances security by eliminating the need to manage or rotate credentials. This Skill automates the transition to trusted publishing, ensuring your GitHub Actions workflows use short-lived authentication.