cheapnud/CheapHelpers
Watch
1
0
Fork
You've already forked CheapHelpers
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Publish via NuGet Trusted Publishing on GitHub #8

Merged
cheapnud merged 1 commit from d/trusted-publishing into master 2026-08-18 13:56:16 +00:00
Conversation 1 Commits 1 Files changed 2 +157 -106
cheapnud commented 2026-08-18 13:53:39 +00:00
Owner
Copy link

NuGet.org is deprecating long-lived API keys in favor of trusted publishing, which only GitHub and GitLab can do (OIDC issuers). Publishing moves back to GitHub Actions with the NuGet/login token exchange; the forge publish workflow is retired since it would need a stored key.

NuGet.org is deprecating long-lived API keys in favor of trusted publishing, which only GitHub and GitLab can do (OIDC issuers). Publishing moves back to GitHub Actions with the NuGet/login token exchange; the forge publish workflow is retired since it would need a stored key.
publish via nuget trusted publishing on github, retire forge publish workflow
All checks were successful
Claude PR Review / AI Code Review (pull_request) Successful in 18s
Details
Build / Build and Test (pull_request) Successful in 2m24s
Details
e02e38ae9c
forgejo-actions commented 2026-08-18 13:53:57 +00:00
Copy link

🤖 Claude AI Code Review

  1. Summary
    Migrates NuGet publishing from Forgejo (stored API key) to GitHub Actions using OIDC-based trusted publishing.

  2. Code Quality ⭐⭐⭐⭐☆
    Clean use of OIDC keyless publishing with well-documented rationale comments and correct scoped id-token: write permissions per job.

  3. Issues

🟡 nuget-publish.yml — pack-media publishes both base and MAUI packages, but publish-media waits 10 minutes for base indexing yet only depends on publish-base. That's fine, but note MAUI packages get published in publish-base before its own indexing — if any base package depends on MAUI or vice-versa the ordering could break restores. Verify dependency direction (likely fine given base excludes MAUI).

🟢 nuget-publish.yml — publish-media re-packs MediaProcessing rather than reusing an artifact, so the built package isn't retained/uploaded like base and MAUI. Inconsistent but not a bug. Also the artifact retention (90 days) on base/maui is unused by publish (they download by name from the same run), so it's harmless.

🟢 The --skip-duplicate on push means a partially-published release won't fail loudly on re-run — intended behavior here, just noting.

  1. Verdict: APPROVE

The workflow is correct: OIDC permissions are properly scoped, no secrets are hardcoded (the retired workflow's stored key is removed), and publish jobs are gated on refs/tags/v. Nothing blocking.

📊 Tokens: 6024 input + 537 output | 💰 Cost: ~$0.0435
Generated by Claude Opus 4.8 via Gitea Actions

## 🤖 Claude AI Code Review 1. **Summary** Migrates NuGet publishing from Forgejo (stored API key) to GitHub Actions using OIDC-based trusted publishing. 2. **Code Quality** ⭐⭐⭐⭐☆ Clean use of OIDC keyless publishing with well-documented rationale comments and correct scoped `id-token: write` permissions per job. 3. **Issues** 🟡 nuget-publish.yml — `pack-media` publishes both base and MAUI packages, but `publish-media` waits 10 minutes for base indexing yet only depends on `publish-base`. That's fine, but note MAUI packages get published in `publish-base` before its own indexing — if any base package depends on MAUI or vice-versa the ordering could break restores. Verify dependency direction (likely fine given base excludes MAUI). 🟢 nuget-publish.yml — `publish-media` re-packs MediaProcessing rather than reusing an artifact, so the built package isn't retained/uploaded like base and MAUI. Inconsistent but not a bug. Also the artifact retention (90 days) on base/maui is unused by publish (they download by name from the same run), so it's harmless. 🟢 The `--skip-duplicate` on push means a partially-published release won't fail loudly on re-run — intended behavior here, just noting. 4. **Verdict**: **APPROVE** The workflow is correct: OIDC permissions are properly scoped, no secrets are hardcoded (the retired workflow's stored key is removed), and publish jobs are gated on `refs/tags/v`. Nothing blocking. --- 📊 **Tokens**: 6024 input + 537 output | 💰 **Cost**: ~$0.0435 *Generated by Claude Opus 4.8 via Gitea Actions*
cheapnud merged commit 083a43fda3 into master 2026-08-18 13:56:16 +00:00
cheapnud deleted branch d/trusted-publishing 2026-08-18 13:56:17 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
cheapnud/CheapHelpers!8
No description provided.