nuget-trusted-publishing

You can publish to nuget.org without API keys by implementing NuGet trusted publishing, which replaces long-lived secrets with short-lived OIDC tokens. This workflow uses GitHub Actions with id-token: write permissions and the NuGet/login action to authenticate securely.

OIDC-based trusted publishing for NuGet is a mechanism that replaces long-lived API keys with short-lived tokens in GitHub Actions. It uses OpenID Connect to authenticate directly with nuget.org, ensuring secure and maintainable package publishing workflows.

To migrate from API keys to OIDC tokens, update your GitHub Actions workflow to use id-token: write permissions and integrate the NuGet/login@v1 action. This removes the need for stored NuGet_API_KEY secrets and uses short-lived tokens instead.

Yes, you can create a GitHub Actions publish workflow that uses OIDC tokens for NuGet trusted publishing while enforcing environment protection and policy compliance. This ensures secure deployments to nuget.org without exposing long-lived secrets.

No, OIDC-based trusted publishing for NuGet is designed specifically for publishing to nuget.org. The workflow avoids publishing to private feeds and focuses on secure, token-based authentication for the public gallery.

You should use OIDC tokens instead of a NuGet API key to eliminate the security risks of storing long-lived secrets. OIDC tokens are short-lived and requested on demand, making your GitHub Actions NuGet publishing workflows more secure and maintainable.