From 622b695d1eb634aa621ec896808e8e5b2bc3fa0e Mon Sep 17 00:00:00 2001
From: Thomas Buck <tbbuck@users.noreply.github.com>
Date: Tue, 23 Jun 2026 23:55:16 +0100
Subject: [PATCH] ci: add NuGet trusted-publishing (OIDC) workflow

Publish the package via NuGet.org Trusted Publishing instead of a long-lived
API key: a GitHub Release triggers a workflow that mints a short-lived token
through OIDC (id-token: write) using the NuGet/login action, then pushes the
packed .nupkg. Requires a one-time trusted-publishing policy on nuget.org and
a NUGET_USER repository variable (documented in the workflow header).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xW2zhMvrJChpY58hfJBeZ
---
 .github/workflows/publish-nuget.yml | 50 +++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 .github/workflows/publish-nuget.yml

diff --git a/.github/workflows/publish-nuget.yml b/.github/workflows/publish-nuget.yml
new file mode 100644
index 0000000..10813ea
--- /dev/null
+++ b/.github/workflows/publish-nuget.yml
@@ -0,0 +1,50 @@
+name: Publish to NuGet
+
+# Publishes the package using NuGet.org Trusted Publishing (OIDC) — no long-lived API key.
+# Triggered by publishing a GitHub Release (recommended), or run manually.
+#
+# One-time setup on nuget.org (Account -> Trusted Publishing):
+#   - Package owner: your nuget.org account
+#   - Repository owner: tbbuck
+#   - Repository:       Hangfire.Storage.SQLite
+#   - Workflow file:    publish-nuget.yml
+#   - (optional) restrict to the "release" environment used below
+# Then set a repository variable NUGET_USER to your nuget.org username
+# (Settings -> Secrets and variables -> Actions -> Variables).
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  id-token: write   # required to request the OIDC token for trusted publishing
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 8.0.x
+
+      - name: Pack
+        run: dotnet pack src/main/Hangfire.Storage.SQLite/Hangfire.Storage.SQLite.csproj -c Release -o artifacts
+
+      - name: NuGet login (Trusted Publishing / OIDC)
+        id: login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ vars.NUGET_USER }}
+
+      - name: Push to NuGet
+        run: >-
+          dotnet nuget push "artifacts/*.nupkg"
+          --api-key "${{ steps.login.outputs.NUGET_API_KEY }}"
+          --source https://api.nuget.org/v3/index.json
+          --skip-duplicate