Migrating to trusted publisher workflow from old key workflow.

.github/workflows/BuildAndPublish.yml

@@ -0,0 +1,36 @@
+name: BuildAndPack
+on:
+  push:
+    branches: [main]
+    tags: ['*']
+  pull_request:
+
+jobs:
+  build-and-publish:
+    permissions:
+      contents: read
+      id-token: write  # enable GitHub OIDC token issuance for this job
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+      - name: release build
+        run: |
+          dotnet build -c Release
+      - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
+      - name: push to NuGet
+        # Only push to NuGet if we're building a tag (optional)
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        run: |
+            dotnet nuget push $_.FullName `
+              --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" `
+              --source https://api.nuget.org/v3/index.json