skills.rest
lewing
lewingCOMMUNITY
Explore all skills by this author →
𝕏@lewingGitHub

nuget-trusted-publishing

Configures NuGet trusted publishing with OIDC tokens for GitHub Actions workflows.

4|1|Updated Feb 19, 2026
Search Tags:#workflow#packaging#dotnet#nuget#oidc#trusted-publishing#nuget.org
One-click install
npx skills add https://github.com/lewing/agent-plugins --skill nuget-trusted-publishing-lewing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: nuget-trusted-publishing
Source: https://github.com/lewing/agent-plugins/tree/main/plugins/lewing/skills/nuget-trusted-publishing
Command: npx skills add https://github.com/lewing/agent-plugins --skill nuget-trusted-publishing-lewing

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This setup enables secure NuGet publishing by replacing long-lived API keys with short-lived OIDC-based tokens for NuGet.org, improving security and key rotation.

Core Features & Use Cases

  • Secure publishing with NuGet trusted publishing and OIDC integration
  • Migrate from NuGet API keys to token-based authentication in GitHub Actions
  • Supports dotnet tool and MCP server publishing workflows with policy guidance and validation

Quick Start

Create a tag-triggered publish workflow from the provided template and customize the dotnet version and project paths, then push a version tag to start trusted NuGet publishing.

Frequently Asked Questions about nuget-trusted-publishing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I publish NuGet packages with OIDC trusted publishing instead of API keys?▼

NuGet trusted publishing replaces long-lived API keys with short-lived OIDC tokens by configuring a GitHub Actions workflow with id-token: write permissions and setting up the corresponding policy on nuget.org.

What is NuGet trusted publishing and how does it secure package workflows?▼

NuGet trusted publishing is a security mechanism that uses OIDC-based tokens instead of static API keys, ensuring short-lived credentials for publishing dotnet tools and MCP servers across public and private repositories.

Can I use trusted publishing to migrate my existing GitHub Actions workflows for NuGet.org?▼

Yes, you can migrate existing GitHub Actions workflows by adopting a tag-triggered publish workflow, customizing dotnet versions and project paths, and configuring the required nuget.org policy for OIDC token validation.

Does NuGet OIDC trusted publishing work for dotnet tools and MCP servers in private repos?▼

Yes, NuGet OIDC trusted publishing supports publishing workflows for dotnet tools and MCP servers across both public and private repositories, provided version alignment between project files is maintained.

Why do I need id-token: write permissions for NuGet OIDC publishing?▼

The id-token: write permission is required in your publish workflow to allow GitHub Actions to request and generate the short-lived OIDC tokens needed to authenticate with nuget.org without API keys.

What are the limitations of replacing NuGet API keys with OIDC tokens?▼

Replacing NuGet API keys with OIDC tokens requires strict version alignment between project files and limits publishing to tag-triggered GitHub Actions workflows, restricting ad-hoc pushes without proper policy setup on nuget.org.

Related Skills

Explore More Software Engineering Skills→
AnveioAnveio
1

devcontainer-sandboxing

Create and harden devcontainer-based sandboxes with least privilege for coding agents.

Community
Advanced
1k-off1k-off
1

nuget-trusted-publishing

Configure GitHub Actions OIDC trusted publishing for NuGet packages.

Community
Advanced
usepowershellusepowershell
9

nuget-github-packages

Publish .NET NuGet packages to GitHub Packages with authenticated pushes.

Community
Intermediate
sayedihashimisayedihashimi
2

nuget-trusted-publishing

Migrate NuGet publishing to OIDC-based tokens in GitHub Actions.

Community
Advanced