Skip to content

ci: use OIDC for NuGet package push authentication #142

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
guitarrapc merged 5 commits into from
Jun 2, 2026
+31 −4
Merged

ci: use OIDC for NuGet package push authentication #142

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
29eb4f8
ci: use OIDC for NuGet package push authentication
guitarrapc May 20, 2026
1a50568
ci: id-token permission
guitarrapc May 20, 2026
a7eae6e
ci: handle SymbolPackageFormat on build
guitarrapc May 20, 2026
3aaa4f9
ci: publish symbol files
guitarrapc May 20, 2026
9646864
ci: add dedicated publish job gated on build and build-unity
guitarrapc May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 31 additions & 4 deletions .github/workflows/build-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ jobs:
# pack nuget
- run: dotnet build -c Release -p:Version=${{ inputs.tag }}
- run: dotnet test tests/ZString.Tests -c Release --no-build
- run: dotnet pack -c Release --no-build -p:Version=${{ inputs.tag }} -o ./publish
- run: dotnet pack -c Release --no-build -p:Version=${{ inputs.tag }} -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o ./publish
# Store artifacts.
- uses: Cysharp/Actions/.github/actions/upload-artifact@main
with:
Expand Down Expand Up @@ -96,8 +96,35 @@ jobs:
path: ./src/ZString.Unity/ZString.Unity.${{ inputs.tag }}.unitypackage
retention-days: 1

# publish
publish:
name: "Publish NuGet packages"
needs: [build-dotnet, build-unity]
permissions:
contents: read
id-token: write # required for NuGet Trusted Publish
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: Cysharp/Actions/.github/actions/setup-dotnet@main
- uses: Cysharp/Actions/.github/actions/download-artifact@main
# push nuget
- name: NuGet login (OIDC)
uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
id: login
with:
user: ${{ secrets.NUGET_USER }}
- run: dotnet nuget push "./nuget/*.nupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
if: ${{ !inputs.dry-run }}
env:
NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
- run: dotnet nuget push "./nuget/*.snupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
if: ${{ !inputs.dry-run }}
env:
NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}

create-release:
needs: [update-packagejson, build-dotnet, build-unity]
needs: [update-packagejson, publish]
permissions:
contents: write
id-token: write # required for NuGet Trusted Publish
Expand All @@ -106,14 +133,14 @@ jobs:
commit-id: ${{ needs.update-packagejson.outputs.sha }}
tag: ${{ inputs.tag }}
dry-run: ${{ inputs.dry-run }}
nuget-push: true
nuget-push: false
release-upload: true
release-asset-path: ./ZString.Unity.${{ inputs.tag }}.unitypackage/ZString.Unity.${{ inputs.tag }}.unitypackage
secrets: inherit

cleanup:
if: ${{ needs.update-packagejson.outputs.is-branch-created == 'true' }}
needs: [update-packagejson, build-dotnet, build-unity]
needs: [update-packagejson, create-release]
permissions:
contents: write
uses: Cysharp/Actions/.github/workflows/clean-packagejson-branch.yaml@main
Expand Down
Loading