From bcd18b7d85f64af92edf8ee63a30db715c4e2ad2 Mon Sep 17 00:00:00 2001
From: linmeideli <2558527373@qq.com>
Date: Fri, 25 Sep 2026 18:17:43 +0800
Subject: [PATCH] ci: use nuget.org trusted publishing (OIDC) instead of static
 key

---
 .github/workflows/nuget.yml | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/nuget.yml b/.github/workflows/nuget.yml
index 90fd47f..10dab1e 100644
--- a/.github/workflows/nuget.yml
+++ b/.github/workflows/nuget.yml
@@ -11,6 +11,9 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - name: Checkout
@@ -44,21 +47,23 @@ jobs:
       - name: Pack
         run: dotnet pack src/Empostor.Api/Empostor.Api.csproj -c Release -p:VersionSuffix=${{ steps.ver.outputs.suffix }} -p:GeneratePackageOnBuild=false -o artifacts --nologo
 
+      # Trusted publishing: exchanges the GitHub OIDC token for a short-lived
+      # nuget.org API key tied to the policy (no secret needed).
+      - name: NuGet login (trusted publishing)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: ELinmei
+
       - name: Push to nuget.org
-        env:
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
         run: |
           set -euo pipefail
           ls -la artifacts
-          if [ -z "$NUGET_API_KEY" ]; then
-            echo "::warning::NUGET_API_KEY secret is not set; skipping push."
-            exit 0
-          fi
           dotnet nuget push "artifacts/Empostor.Api.*.nupkg" \
-            --api-key "$NUGET_API_KEY" \
+            --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" \
             --source https://api.nuget.org/v3/index.json \
             --skip-duplicate
           dotnet nuget push "artifacts/Empostor.Api.*.snupkg" \
-            --api-key "$NUGET_API_KEY" \
+            --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" \
             --source https://api.nuget.org/v3/index.json \
             --skip-duplicate || true