feat: Migrate NuGet publish to trusted publishing (OIDC)

[BenjaminMichaelis]

Replaces the long-lived NUGET_API_KEY secret with OIDC-based trusted publishing via NuGet/login@v1.

Changes

• Added permissions: id-token: write + contents: read to the deploy job
• Added NuGet/login@v1 step before the push step
• Replaced --api-key ${{ secrets.NUGET_API_KEY }} with --api-key ${{ steps.login.outputs.NUGET_API_KEY }}

Setup required before merging

1. nuget.org trusted publishing policy

Go to nuget.org/account/trustedpublishing → Add policy:

Field	Value
Repository Owner	BenjaminMichaelis
Repository	TrxLib
Workflow File	deploy.yml
Environment	Production

2. GitHub Environment secret

Repo Settings → Environments → Production → add secret:

• Name: NUGET_USER
• Value: your nuget.org profile name (NOT email)

3. After first successful publish

Once verified working, you can delete the old NUGET_API_KEY secret.

[Copilot]

Pull request overview

Migrates the NuGet publish workflow from a long-lived NUGET_API_KEY secret to OIDC-based trusted publishing using NuGet/login@v1, aligning the deploy pipeline with a more secure authentication model for nuget.org.

Changes:

• Scoped the deploy job permissions to enable OIDC token minting (id-token: write) and repository read access (contents: read).
• Added a NuGet/login@v1 step to obtain a short-lived NuGet API key via trusted publishing.
• Updated dotnet nuget push to use the API key provided by the login step output instead of a repository secret.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.