From 4e018b691bea499aa7ccb1d5821906461430ad6a Mon Sep 17 00:00:00 2001 From: Jamie Taylor Date: Sat, 18 Oct 2025 20:34:55 +0100 Subject: [PATCH 1/4] Changes required to perform trusted publishing, rather than API key-based publishing --- .github/workflows/release.yml | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3aee5fa..76de843 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -78,6 +78,7 @@ jobs: needs: [build, test] runs-on: ubuntu-latest name: Create and upload NuGet package + environment: production steps: - name: Checkout code @@ -99,13 +100,17 @@ jobs: - name: Build NuGet package run: dotnet pack src/OwaspHeaders.Core.csproj --configuration Release - + - name: Generate Attestations uses: actions/attest-build-provenance@963f8a02f24ac90336362e63ca6730cf69ad102e # v2.1.0 with: subject-path: ${{ github.workspace }}/**/*.nupkg - + + - name: NuGet login (OIDC → temp API key) + uses: NuGet/login@v1 + id: nuget-login + with: + user: ${{ secrets.NUGET_USER }} + - name: Push NuGet package - run: dotnet nuget push **\*.nupkg --source 'https://api.nuget.org/v3/index.json' --api-key ${{secrets.NUGET_API_KEY}} - env: - GITHUB_TOKEN: ${{ secrets.NUGET_API_KEY }} \ No newline at end of file + run: dotnet nuget push **\*.nupkg --source 'https://api.nuget.org/v3/index.json' --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} \ No newline at end of file From 0ce4c2a811435db5a72410ce2215c5d33f8e3474 Mon Sep 17 00:00:00 2001 From: Jamie Taylor Date: Sat, 18 Oct 2025 20:43:42 +0100 Subject: [PATCH 2/4] Updated the path variable used in the dotnet nuget push command. --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 76de843..c9f2e83 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -113,4 +113,4 @@ jobs: user: ${{ secrets.NUGET_USER }} - name: Push NuGet package - run: dotnet nuget push **\*.nupkg --source 'https://api.nuget.org/v3/index.json' --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} \ No newline at end of file + run: dotnet nuget push **/*.nupkg --source 'https://api.nuget.org/v3/index.json' --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} \ No newline at end of file From baafec1f7eb250c4b13188752f8215efd3e9eb50 Mon Sep 17 00:00:00 2001 From: Jamie Taylor Date: Sat, 18 Oct 2025 20:47:23 +0100 Subject: [PATCH 3/4] Removed secrets.NUGET_USER variable use; Also moved the relevant permissions for the package task --- .github/workflows/release.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c9f2e83..d8db2f5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -79,6 +79,9 @@ jobs: runs-on: ubuntu-latest name: Create and upload NuGet package environment: production + permissions: + id-token: write + attestations: write steps: - name: Checkout code @@ -109,8 +112,6 @@ jobs: - name: NuGet login (OIDC → temp API key) uses: NuGet/login@v1 id: nuget-login - with: - user: ${{ secrets.NUGET_USER }} - name: Push NuGet package run: dotnet nuget push **/*.nupkg --source 'https://api.nuget.org/v3/index.json' --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} \ No newline at end of file From c1b3e9ef2479226335d24912748483f945a7306b Mon Sep 17 00:00:00 2001 From: Jamie Taylor Date: Sat, 18 Oct 2025 20:56:02 +0100 Subject: [PATCH 4/4] NuGet publish action is now idempotent through the use of --skip-duplicate --- .github/workflows/release.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d8db2f5..9df2ce9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -114,4 +114,7 @@ jobs: id: nuget-login - name: Push NuGet package - run: dotnet nuget push **/*.nupkg --source 'https://api.nuget.org/v3/index.json' --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} \ No newline at end of file + # use of --skip-duplicate here will stop NuGet from complaining + # if we try to publish the same version multiple times by making + # publish actions idempotent. + run: dotnet nuget push **/*.nupkg --source 'https://api.nuget.org/v3/index.json' --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --skip-duplicate \ No newline at end of file