skills.rest
Netcodr81
Netcodr81COMMUNITY
Explore all skills by this author →
GitHub

nuget-trusted-publishing

Configures OIDC-based NuGet trusted publishing in GitHub Actions workflows.

Updated Jul 20, 2026
Search Tags:#ci/cd#github actions#dotnet#nuget#oidc#trusted publishing#package publishing
One-click install
npx skills add https://github.com/Netcodr81/kinetic-reports --skill nuget-trusted-publishing-netcodr81
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: nuget-trusted-publishing
Source: https://github.com/Netcodr81/kinetic-reports/tree/main/.github/skills/nuget-trusted-publishing
Command: npx skills add https://github.com/Netcodr81/kinetic-reports --skill nuget-trusted-publishing-netcodr81

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Publishing NuGet packages with long-lived API keys creates security risks and secret rotation overhead. This Skill migrates GitHub Actions repos to NuGet trusted publishing, replacing stored API keys with short-lived OIDC tokens. ## Core Features & Use Cases - Repo Assessment: Classifies packable projects (library, dotnet tool, MCP server, template) by inspecting .csproj and Directory.Build.props, then validates required packaging properties. - Guided nuget.org Policy Setup: Walks the user through creating a trusted publishing policy with the exact repository owner, repo name, and workflow filename. - Workflow Creation and Migration: Generates a tag-triggered publish workflow using NuGet/login@v1 with id-token: write, or converts an existing API-key workflow in place. - Use Case: A developer with a .NET tool currently pushed via secrets.NUGET_API_KEY asks to remove the API key; the Skill audits the project, drafts the OIDC workflow, and guides the nuget.org policy setup before any secrets are deleted. ## Quick Start Set up NuGet trusted publishing for this repo and migrate my publish workflow away from the stored API key.

Frequently Asked Questions about nuget-trusted-publishing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up NuGet trusted publishing in GitHub Actions?▼

Create a trusted publishing policy at nuget.org/account/trustedpublishing with your repo owner, repo name, and exact workflow filename. Then add id-token: write permission and a NuGet/login@v1 step to your workflow, and push using the token from steps.login.outputs.NUGET_API_KEY.

How to migrate from NuGet API key to OIDC publishing?▼

Add id-token: write to the publish job permissions, insert a NuGet/login@v1 step with your nuget.org username as the NUGET_USER secret, and replace the API key with the login step output. Keep the old API key secret until the first OIDC publish succeeds.

Does NuGet trusted publishing work with private feeds or Azure Artifacts?▼

No. NuGet trusted publishing via OIDC is supported only for nuget.org. Publishing to private feeds or Azure Artifacts still requires their own authentication mechanisms such as PATs or service connections.

Why does NuGet/login fail with a 403 error?▼

A 403 from NuGet/login almost always means the job is missing the id-token: write permission. Add it explicitly under the job's permissions block, since setting any permissions overrides GitHub's defaults.

Why does nuget.org report no matching trusted publishing policy?▼

The policy requires the exact workflow filename, such as publish.yml, with no path prefix; matching is case-insensitive. Verify the filename on nuget.org matches the actual file in .github/workflows, not the workflow's name field.

Related Skills

Explore More Software Engineering Skills→
AGIBuildAGIBuild
10

dotnet-version-detection

Detect .NET TFMs and SDK versions from project files.

Community
Intermediate
AEtherlight-aiAEtherlight-ai

publish

Automate ÆtherLight release publishing to npm and GitHub.

Official
Intermediate
DexploarerDexploarer
6

github-actions-workflow-builder

Generate GitHub Actions CI/CD workflow YAML files for multiple project types.

Community
Intermediate
sayedihashimisayedihashimi
2

nuget-trusted-publishing

Migrate NuGet publishing to OIDC-based tokens in GitHub Actions.

Community
Advanced