From 0e0d39a095cb12fec5b0b54a911004043961d2ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Valentin=20Breu=C3=9F?= <vbreuss@gmail.com>
Date: Thu, 5 Nov 2026 16:25:08 +0100
Subject: [PATCH] ci: use NuGet trusted publishing to avoid long-lived API keys

---
 .github/workflows/build.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fcebfae4d..b38bef712 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -151,6 +151,7 @@ jobs:
     needs: [ pack ]
     permissions:
       contents: write
+      id-token: write
     steps:
       - name: Download packages
         uses: actions/download-artifact@v8
@@ -159,6 +160,11 @@ jobs:
           path: Artifacts/Packages
       - name: Setup .NET SDKs
         uses: actions/setup-dotnet@v6
+      - name: NuGet login
+        id: login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ secrets.NUGET_USER }}
       - name: Publish
         run: |
           echo "Found the following packages to push:"
@@ -169,7 +175,7 @@ jobs:
           done
           for entry in Artifacts/Packages/*.nupkg
           do
-            dotnet nuget push $entry --source https://api.nuget.org/v3/index.json --api-key "${{secrets.NUGET_API_KEY}}" --skip-duplicate
+            dotnet nuget push $entry --source https://api.nuget.org/v3/index.json --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" --skip-duplicate
           done
       - name: Check pre-release
         id: check-pre-release