Skip to content

Publish to NuGet via trusted publishing on version tags - #8

Merged
onionhammer merged 2 commits into
masterfrom
trusted-publishing
Oct 17, 2026
Merged

onionhammer merged 2 commits into
masterfrom
trusted-publishing

Conversation

@onionhammer

@onionhammer onionhammer commented Oct 17, 2026 •

Copy link
Copy Markdown
Collaborator

Adds .github/workflows/release.yml. Pushing a v* tag now:

  1. Runs the tests
  2. Packs Sprog
  3. Fails if the tag doesn't match <Version> in Sprog.csproj (e.g. tag v0.5.0 requires Wivuu.Sprog.0.5.0.nupkg)
  4. Gets a 1-hour nuget.org API key through NuGet/login@v1 (GitHub OIDC), so no long-lived key is stored
  5. Pushes the package to nuget.org

One-time setup before the first release

  • nuget.org → your username → Trusted Publishing → add a policy:
    • Policy owner: Wivuu (the org that owns Wivuu.Sprog)
    • Repository owner: wivuu (the repo moved from onionhammer; OIDC tokens carry the current owner)
    • Repository: Wivuu.Sprog
    • Workflow file: release.yml
    • Environment: leave empty
  • Repo variable NUGET_USER: nuget.org profile name (already set to erikoleary)

Releasing

Bump <Version> and <PackageReleaseNotes> in Sprog/Sprog.csproj, merge, then:

git tag v0.5.0 && git push origin v0.5.0

🤖 Generated with Claude Code

https://claude.ai/code/session_012F1ejNxhWMkZ4BKFNUi7YP

onionhammer and others added 2 commits October 17, 2026 11:12
Pushing a v* tag runs the tests, packs Sprog, checks the tag matches
<Version> in Sprog.csproj, and pushes the package using a short-lived
API key from NuGet/login (OIDC) instead of a stored secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012F1ejNxhWMkZ4BKFNUi7YP
@onionhammer
onionhammer merged commit 9e60e70 into master Oct 17, 2026
1 check passed
@onionhammer
onionhammer deleted the trusted-publishing branch October 17, 2026 16:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant