CI: migrate to Trusted Publishing Policy

Author: ForNeVeR

.github/workflows/release.yml

@@ -65,9 +65,15 @@ jobs:
           ./TruePath.SystemIo/bin/Release/TruePath.SystemIo.${{ steps.version.outputs.version }}.nupkg
           ./TruePath.SystemIo/bin/Release/TruePath.SystemIo.${{ steps.version.outputs.version }}.snupkg
         name: TruePath v${{ steps.version.outputs.version }}
+    - if: startsWith(github.ref, 'refs/tags/v')
+      id: nuget-login
+      name: Log in to NuGet
+      uses: NuGet/login@v1
+      with:
+        user: ${{ secrets.NUGET_USER }}
     - if: startsWith(github.ref, 'refs/tags/v')
       name: Push TruePath to NuGet
       run: dotnet nuget push ./TruePath/bin/Release/TruePath.${{ steps.version.outputs.version }}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_TOKEN_TRUE_PATH }}
     - if: startsWith(github.ref, 'refs/tags/v')
       name: Push TruePath.SystemIo to NuGet
-      run: dotnet nuget push ./TruePath.SystemIo/bin/Release/TruePath.SystemIo.${{ steps.version.outputs.version }}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_TOKEN_TRUE_PATH_SYSTEM_IO }}
+      run: dotnet nuget push ./TruePath.SystemIo/bin/Release/TruePath.SystemIo.${{ steps.version.outputs.version }}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }}

MAINTAINING.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-FileCopyrightText: 2024-2025 Friedrich von Never <friedrich@fornever.me>
+SPDX-FileCopyrightText: 2024-2026 Friedrich von Never <friedrich@fornever.me>
 
 SPDX-License-Identifier: MIT
 -->
@@ -15,27 +15,28 @@ Publish a New Version
 4. Prepare a corresponding entry in the `CHANGELOG.md` file (usually by renaming the "Unreleased" section).
 5. Set `<Version>` in the `Directory.Build.props` file.
 6. Merge the aforementioned changes via a pull request.
-7. Check if the NuGet keys are still valid (see the **Rotate NuGet Publishing Keys** section if they aren't).
+7. If you want to publish a new package (not a new version, but a new project/package) change the NuGet Trusted Publishing Policy: switch from **push only new packages versions** to **push new packages and package versions** (see below for more details).
 8. Push a tag in form of `v<VERSION>`, e.g. `v0.0.0`. GitHub Actions will do the rest (push a NuGet packages).
-
-Rotate NuGet Publishing Keys
-----------------------------
-CI relies on NuGet API keys being added to the secrets.
-From time to time, these keys require maintenance: they will become obsolete and will have to be updated.
-
-To update the key:
-
-1. Sign in onto nuget.org.
-2. Go to the [API keys][nuget.api-keys] section.
-3. Update the existing or create a new key named `truepath.github` with a permission to **Push only new package versions** and only allowed to publish the package **TruePath**.
-
-   (If this is the first publication of a new package,
-   upload a temporary short-living key with permission to add new packages and rotate it afterward.)
-4. Update the existing or create a new key named `truepath.systemio.github` with a permission to **Push only new package versions** and only allowed to publish the package **TruePath.SystemIo**.
-
-   (If this is the first publication of a new package,
-   upload a temporary short-living key with permission to add new packages and rotate it afterward.)
-5. Paste the generated keys, correspondingly, to the `NUGET_TOKEN_TRUE_PATH` and `NUGET_TOKEN_TRUE_PATH_SYSTEM_IO` variables on the [action secrets][github.secrets] section of GitHub settings.
-
+9. If you were publishing a new package, revert back the change you did at step 8.
+
+NuGet Publishing Policy
+-----------------------
+This repository relies on [NuGet Trusted Publishing][docs.nuget-trusted-publishing] policy. In case you need to create it again, follow these steps:
+
+1. Sign in to nuget.org.
+2. Go to the [Trusted Publishing][nuget.trusted-publishing] section.
+3. Create a new policy:
+    - **Policy Name:** `github.truepath`.
+    - **Repository Owner:** `ForNeVeR`.
+    - **Repository**: `TruePath`.
+    - **Workflow File**: `release.yml`.
+    - **Environment:** _leave empty_.
+    - **Scope:** **push only new packages versions**.
+    - **Glob Patterns and Packages**: `TruePath*`.
+4. Put your nuget.org username into the `NUGET_USER` variable on the [action secrets][github.secrets] section of GitHub settings.
+
+When introducing a new package, you can adjust the policy temporarily to allow it to **push new packages and package versions**.
+
+[docs.nuget-trusted-publishing]: https://learn.microsoft.com/en-us/nuget/nuget-org/trusted-publishing
 [github.secrets]: https://github.com/ForNeVeR/TruePath/settings/secrets/actions
-[nuget.api-keys]: https://www.nuget.org/account/apikeys
+[nuget.trusted-publishing]: https://www.nuget.org/account/trustedpublishing

scripts/github-actions.fsx

@@ -164,8 +164,9 @@ let workflows = [
                 ]
             )
 
+            let whenPushingTag = "startsWith(github.ref, 'refs/tags/v')"
             step(
-                condition = "startsWith(github.ref, 'refs/tags/v')",
+                condition = whenPushingTag,
                 name = "Create a release",
                 usesSpec = Auto "softprops/action-gh-release",
                 options = Map.ofList [
@@ -175,14 +176,23 @@ let workflows = [
                 ]
             )
             step(
-                condition = "startsWith(github.ref, 'refs/tags/v')",
+                condition = whenPushingTag,
+                id = "nuget-login",
+                name = "Log in to NuGet",
+                usesSpec = Auto "NuGet/login",
+                options = Map.ofList [
+                    "user", "${{ secrets.NUGET_USER }}"
+                ]
+            )
+            step(
+                condition = whenPushingTag,
                 name = "Push TruePath to NuGet",
                 run = $"dotnet nuget push ./TruePath/bin/Release/TruePath.{versionField}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{{{ secrets.NUGET_TOKEN_TRUE_PATH }}}}"
             )
             step(
-                condition = "startsWith(github.ref, 'refs/tags/v')",
+                condition = whenPushingTag,
                 name = "Push TruePath.SystemIo to NuGet",
-                run = $"dotnet nuget push ./TruePath.SystemIo/bin/Release/TruePath.SystemIo.{versionField}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{{{ secrets.NUGET_TOKEN_TRUE_PATH_SYSTEM_IO }}}}"
+                run = $"dotnet nuget push ./TruePath.SystemIo/bin/Release/TruePath.SystemIo.{versionField}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{{{ steps.nuget-login.outputs.NUGET_API_KEY }}}}"
             )
         ]
     ]