From 4769df5ea9a03eb8f0a3ca2ba59bb6b034edee5a Mon Sep 17 00:00:00 2001
From: Mike <veldsinkie.mv@gmail.com>
Date: Sat, 31 Oct 2026 01:01:13 +0100
Subject: [PATCH] ci: publish to nuget.org with trusted publishing

Swaps the long-lived NUGET_TOKEN for a short-lived API key from
NuGet/login, which exchanges the GitHub OIDC token. The old key had
expired, so the 1.0.2 push to nuget.org failed with a 403.
---
 .github/workflows/dotnet.yml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 7e0c690..c672abe 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -7,6 +7,11 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      # Trusted publishing exchanges the GitHub OIDC token for a short-lived nuget.org API key.
+      id-token: write
     steps:
     - uses: actions/checkout@v3
     - name: Setup .NET
@@ -29,8 +34,14 @@ jobs:
     - name: Push to GitHub Packages
       run: dotnet nuget push ./artifacts/*.nupkg -k ${{ secrets.GITHUB_TOKEN }} -s https://nuget.pkg.github.com/top-gg/index.json --skip-duplicate
       if: github.ref == 'refs/heads/master'
+    - name: Log in to NuGet
+      id: nuget-login
+      uses: NuGet/login@v1
+      with:
+        user: ${{ secrets.NUGET_USER }}
+      if: github.ref == 'refs/heads/master'
     - name: Push to Nuget
-      run: dotnet nuget push ./artifacts/*.nupkg -k ${{ secrets.NUGET_TOKEN }} -s https://api.nuget.org/v3/index.json --skip-duplicate
+      run: dotnet nuget push ./artifacts/*.nupkg -k ${{ steps.nuget-login.outputs.NUGET_API_KEY }} -s https://api.nuget.org/v3/index.json --skip-duplicate
       if: github.ref == 'refs/heads/master'
 
 env: