[AndreaCuneo]

Summary

Moves NuGet publishing to NuGet trusted publishing, as done in ARKlab/Ark.Tools#1294: no long-lived API key is stored, and a key cannot expire in the middle of a release.

.github/workflows/publish_nuget.yml:

• The deploy job (now named Pack, still on Windows) packs as before but no longer pushes: it uploads the output folder as the artifact packages.
• New job Push to NuGet (publish, needs: deploy, Ubuntu): the only job with id-token: write. It runs in the GitHub environment nuget, downloads the packages, exchanges the OIDC token for a one-hour NuGet key (NuGet/login) and pushes output/*.nupkg (the .snupkg symbol packages go with them, as before). It runs no repository code. Its actions are pinned to commits, and the key reaches the push through env.
• --skip-duplicate is added, so a re-run after a partial push does not fail on packages already on nuget.org.
• Pull requests and branch pushes never reach the push job: deploy runs only on v* tag pushes.

Setup needed before the next release tag

1. GitHub environment: Settings → Environments → New environment nuget. No required reviewers. Deployment branches and tags → Selected branches and tags → add a rule of type Tag with pattern v*. Create it before the next tag: if it does not exist, GitHub creates it on the first run without the tag rule.
2. Secret: add NUGET_USER (the nuget.org user name that creates the policy) as an environment secret of nuget or as a repository secret.
3. nuget.org: Trusted Publishing → add a policy. Package owner Ark_Lab, repository owner ARKlab, repository MessagePack, workflow file publish_nuget.yml, environment nuget. If the form offers a package scope, set it to MessagePack.NodaTime.
4. After the first successful release: delete the NUGET_AUTH_TOKEN secret and revoke its key on nuget.org.

If only the push fails, re-run the Push to NuGet job alone: the packages stay in the artifact.

Known limits, not changed here

• The Pack job keeps version-tag action references, including the third-party battila7/get-version-action@v2. It cannot get the key, but it builds what is published.

Verification

• The YAML parses. Effective permissions: Pack contents: read; Push to NuGet only id-token: write.
• Paths checked: the Windows upload of ${{ github.workspace }}\output and the Ubuntu download to output; SymbolPackageFormat is snupkg, so *.nupkg matches only the main package.
• Action inputs and outputs checked against the action.yml files; each pinned commit matches its version tag (git ls-remote).
• Not run: a real tag run.

---

Generated by Claude Code

[github-code-quality]

Code coverage overview

Languages: C#

C# / code-coverage/net10.0

master 9d91a0c	feature/nuget-truste... 487f7fe	+/-
82%	82%	0%

C# / code-coverage/net8.0

master 9d91a0c	feature/nuget-truste... 487f7fe	+/-
82%	82%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated November 13, 2026 09:52 UTC}