[ddaspit]

Quick summary

Tagged releases now push to nuget.org with a short-lived key from trusted publishing. The long-lived NUGET_API_KEY secret is no longer used. Build, test, and pack steps are unchanged.

Where to look

• New publish job -- the only job with id-token: write. It runs in the nuget environment, which accepts only v* tags.
• Nothing exercises login or push until the next release tag.

After the first release

• Delete NUGET_API_KEY and revoke that key on nuget.org.

Validation

• python -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml'))" -- parses
• git diff --check master...HEAD -- clean
• ./local_check.sh -- not run; the change is workflow-only and touches no build or test input

🤖 Generated with Claude Code

---

This change is 

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.93%. Comparing base (7cd1cd1) to head (4b337d9).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #622   +/-   ##
=======================================
  Coverage   74.93%   74.93%           
=======================================
  Files         454      454           
  Lines       38490    38490           
  Branches     5322     5322           
=======================================
  Hits        28843    28843           
  Misses       8495     8495           
  Partials     1152     1152           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Enkidu93]

@Enkidu93 reviewed 1 file and all commit messages, and made 1 comment.
Reviewable status: all files reviewed, 2 unresolved discussions (waiting on ddaspit).

[claude]

1. Verdict: approve. The new publish job is correct: it runs only on v* tags, in the nuget environment, and is the only job that can request an OIDC token. It downloads the nuget-package artifact to the artifacts/ path that the quoted push glob expects.
2. Most important: none open. F1 (.github/workflows/ci.yml:119) is addressed by the tag-only nuget environment.
3. Critical 0, Important 0, Low 0 open.
4. Read the diff 0db10a13..4b337d91 (compare status ahead). gh api repos/sillsdev/machine/environments/nuget/deployment-branch-policies returns a single tag policy, v*. gh pr checks 622: changes and comment hygiene pass; Build on ubuntu-22.04 and windows-latest are pending.
5. Could not verify the nuget.org side. The comment at ci.yml:118 says the policy trusts only the nuget environment, but the author says that binding is still being made. Until it is, the job-level tag guard is the only guard. Login and push stay unexercised until the first v* tag.

Public API, target framework, package, or machine.py parity contract changed: None verified. Releases now depend on the nuget.org trust policy and the NUGET_USER secret.

Findings: F1 addressed; F2 withdrawn, unverified.

Reviewed at 4b337d9