nuget-trusted-publishing

NuGet trusted publishing uses GitHub Actions OIDC to issue short-lived tokens via NuGet/login@v1, replacing long-lived API keys. It requires setting permissions id-token: write in your workflow and configuring the nuget.org trusted publishing policy beforehand.

NuGet trusted publishing is an OIDC-based mechanism that exchanges a GitHub Actions identity token for a short-lived NuGet publishing token. It removes the need to store long-lived API keys by verifying the workflow's origin and permissions on each run.

To migrate an existing workflow to OIDC trusted publishing, you update your publish workflow to remove API key usage and replace it with the NuGet/login@v1 action while setting permissions id-tag: write. The process safely transitions dotnet libraries, tools, and templates to short-lived tokens.

Yes, OIDC trusted publishing supports publishing dotnet libraries, tools, templates, and MCP server packages to nuget.org. The setup validates packable project metadata like PackageId and Version to ensure successful tag-triggered deployments.

A key limitation is the strict requirement for workflow filename alignment and valid packable project metadata. Version or filename mismatches will break the tag-triggered publish workflow, and you must validate the nuget.org trusted publishing policy before setup.