From b27f79c94d8a665e0be25bdb1a2091a5b008cab0 Mon Sep 17 00:00:00 2001
From: Arius <contact@caeriusnet.dev>
Date: Mon, 6 Jul 2026 13:32:19 +0200
Subject: [PATCH] chore: update NuGet publishing process to use temporary API
 key from OIDC login

---
 .github/workflows/release.yml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 197f008..c64122d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -183,15 +183,21 @@ jobs:
       - name: List packages
         run: ls -la ./packages/
 
-      # ── Publish → NuGet.org ────────────────────────────────────────────────────
+      # ── Publish → NuGet.org (Trusted Publishing) ───────────────────────────────
+      - name: NuGet login (OIDC → clé API temporaire)
+        id: nuget_login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
       - name: Publish → NuGet.org
         run: |
           dotnet nuget push ./packages/*.nupkg \
-            --api-key "${{ secrets.NUGET_API_KEY }}" \
+            --api-key "${{ steps.nuget_login.outputs.NUGET_API_KEY }}" \
             --source https://api.nuget.org/v3/index.json \
             --skip-duplicate
           dotnet nuget push ./packages/*.snupkg \
-            --api-key "${{ secrets.NUGET_API_KEY }}" \
+            --api-key "${{ steps.nuget_login.outputs.NUGET_API_KEY }}" \
             --source https://api.nuget.org/v3/index.json \
             --skip-duplicate || true