chore(ci): revert to enable trusted publishing workflow

[SoulPancake]

Reverts #167

closes: #123

Related:

• chore(ci): add trusted publishing to nuget & dual publish to GitHub Registry #160
• fix: add contents read permission to publish workflow #166
• chore(ci) : revert to previous publish workflow #167

Summary by CodeRabbit

• Infrastructure
  • Packages are now published to GitHub Package Registry in addition to NuGet.org, providing additional distribution options for users.

[coderabbitai]

Walkthrough

The .github/workflows/main.yaml publish job now uses OIDC authentication via NuGet/login (OIDC) instead of environment-based secrets, and publishes packages to both NuGet.org and GitHub Package Registry (with symbol-push failures tolerated).

Changes

NuGet Publishing Workflow Update

Layer / File(s)	Summary
OIDC Authentication .github/workflows/main.yaml	New NuGet/login (OIDC) step authenticates using secrets.NUGET_USER and outputs NUGET_API_KEY for subsequent publish commands.
NuGet.org Publishing .github/workflows/main.yaml	Updated dotnet nuget push to use steps.login.outputs.NUGET_API_KEY and target https://api.nuget.org/v3/index.json, replacing the prior NUGET_AUTH_TOKEN environment variable approach.
GitHub Package Registry Publishing .github/workflows/main.yaml	New step publishes .nupkg and .snupkg to https://nuget.pkg.github.com/openfga/index.json using secrets.GITHUB_TOKEN, with symbol-push errors suppressed and the step marked continue-on-error: true.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• chore(ci): add trusted publishing to nuget & dual publish to GitHub Registry #160: Modifies the same GitHub Actions workflow to implement OIDC NuGet authentication and add dual publishing to GitHub Packages.
• chore(ci) : revert to previous publish workflow #167: Modifies the same publish workflow with inverse changes (removes OIDC and GitHub Packages publishing).

Suggested reviewers

• ewanharris

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and specifically describes the main change: reverting to enable trusted publishing workflow in CI/CD configuration.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch revert-167-chore/ci/revert-to-previous-publish-wf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/main.yaml (1)

244-250: ⚡ Quick win

Avoid masking real symbol-push failures.

On Line 249 and Line 257, || echo "No symbol package found or already published." also swallows real push errors (auth/network/service), which can hide release issues.

Proposed adjustment

       - name: Publish to NuGet
         run: |
           echo "Publishing primary package to NuGet (.nupkg)...";
           dotnet nuget push dist/OpenFga.Sdk.*.nupkg --api-key ${{steps.login.outputs.NUGET_API_KEY}} --skip-duplicate --source https://api.nuget.org/v3/index.json
           echo "Publishing symbol package to NuGet (.snupkg)...";
-          dotnet nuget push dist/OpenFga.Sdk.*.snupkg --api-key ${{steps.login.outputs.NUGET_API_KEY}} --skip-duplicate --source https://api.nuget.org/v3/index.json || echo "No symbol package found or already published."
+          if compgen -G "dist/OpenFga.Sdk.*.snupkg" > /dev/null; then
+            dotnet nuget push dist/OpenFga.Sdk.*.snupkg --api-key ${{steps.login.outputs.NUGET_API_KEY}} --skip-duplicate --source https://api.nuget.org/v3/index.json
+          else
+            echo "No symbol package found."
+          fi

       - name: Publish to GitHub Package Registry
         continue-on-error: true
         run: |
           echo "Publishing primary package to GitHub Package Registry (.nupkg)...";
           dotnet nuget push dist/OpenFga.Sdk.*.nupkg --api-key ${{ secrets.GITHUB_TOKEN }} --skip-duplicate --source https://nuget.pkg.github.com/openfga/index.json
           echo "Publishing symbol package to GitHub Package Registry (.snupkg)...";
-          dotnet nuget push dist/OpenFga.Sdk.*.snupkg --api-key ${{ secrets.GITHUB_TOKEN }} --skip-duplicate --source https://nuget.pkg.github.com/openfga/index.json || echo "No symbol package found or already published."
+          if compgen -G "dist/OpenFga.Sdk.*.snupkg" > /dev/null; then
+            dotnet nuget push dist/OpenFga.Sdk.*.snupkg --api-key ${{ secrets.GITHUB_TOKEN }} --skip-duplicate --source https://nuget.pkg.github.com/openfga/index.json
+          else
+            echo "No symbol package found."
+          fi

Also applies to: 251-258

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/main.yaml around lines 244 - 250, The current publish step
masks real failures by appending "|| echo 'No symbol package found or already
published.'" to the dotnet nuget push for symbol packages (the command matching
"dotnet nuget push dist/OpenFga.Sdk.*.snupkg"), which hides auth/network/service
errors; modify the job so it first checks for the presence of symbol files
(e.g., glob for dist/OpenFga.Sdk.*.snupkg) and only attempts dotnet nuget push
when files exist, and remove the trailing "|| echo ..." fallback so that dotnet
nuget push failures (auth/network/service) surface and fail the workflow—ensure
the primary push command ("dotnet nuget push dist/OpenFga.Sdk.*.nupkg") remains
unchanged and still uses --skip-duplicate but does not swallow errors.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/main.yaml:
- Around line 244-250: The current publish step masks real failures by appending
"|| echo 'No symbol package found or already published.'" to the dotnet nuget
push for symbol packages (the command matching "dotnet nuget push
dist/OpenFga.Sdk.*.snupkg"), which hides auth/network/service errors; modify the
job so it first checks for the presence of symbol files (e.g., glob for
dist/OpenFga.Sdk.*.snupkg) and only attempts dotnet nuget push when files exist,
and remove the trailing "|| echo ..." fallback so that dotnet nuget push
failures (auth/network/service) surface and fail the workflow—ensure the primary
push command ("dotnet nuget push dist/OpenFga.Sdk.*.nupkg") remains unchanged
and still uses --skip-duplicate but does not swallow errors.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2be3b665-b12c-40e5-8ad3-a0f05bd49392

📥 Commits

Reviewing files that changed from the base of the PR and between 996f018 and e7c7f05.

📒 Files selected for processing (1)

• .github/workflows/main.yaml