using secrets.GITHUB_TOKEN to restore NuGet packages from private registry

[anmelegov]

Is it possible to use ${{ secrets.GITHUB_TOKEN }} as a credentials to restore NuGet packages from GitHub Packages Registry? I've tried to do it in the way that is mentioned in documentation but didn't succeed. This is worked for me when pushing but I'm receiving the 403 error when trying to fetch. I suggests that it's failing to write the value of this variable to the local NuGet config when executing dotnet nuget add source due to security reasons. Could someone tell me what I'm doing wrong? Here is my workflow

name: PublishReleaseArtifacts

on:
  push:
    branches: [ "main" ]

jobs:
  build_and_publish_release_artifacts:
    runs-on: ubuntu-latest        

    permissions:
      contents: read
      packages: write        

    steps:
      - name: 'Checkout'
        uses: 'actions/checkout@v4'

      - name: 'Setup .NET'
        uses: 'actions/setup-dotnet@v3'
        with:
          dotnet-version: 6.0.x
          
      - name: 'Add NuGet source'
        run: |
          dotnet nuget add source "https://nuget.pkg.github.com/username/index.json" \
            -n "github" \
            -u "username" \
            -p ${{ secrets.GITHUB_TOKEN }} \
            --store-password-in-clear-text

      - name: 'Run tests'
        run: |
          dotnet restore # <== It's failing here
          dotnet build --no-restore --configuration Release
          dotnet test --no-build --configuration Release --verbosity normal

      - name: 'Determine version'
        id: 'version'
        run: |
          print_version=$GITHUB_WORKSPACE/.github/workflows/print_version.sh
          chmod +x $print_version
          
          echo "value=$($print_version)" >> "$GITHUB_OUTPUT"

      - name: 'Pack and push NuGets'
        run: |
          dotnet pack --no-build --configuration Release -p:PackageVersion=${{ steps.version.outputs.value }}
          dotnet nuget push "**/*.nupkg" --api-key ${{ secrets.GITHUB_TOKEN }} --source "github" # <== this works as expected because the token is provided as an argument

      - name: 'Login via Azure CLI'
        uses: 'azure/login@v1'
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: 'Build and push container image'
        uses: 'azure/docker-login@v1'
        with:
          login-server: projectname.azurecr.io
          username: ${{ secrets.AZURE_REGISTRY_USERNAME }}
          password: ${{ secrets.AZURE_REGISTRY_PASSWORD }}
      - run: |
          docker build -t projectname.azurecr.io/${{ vars.IMAGE_NAME }}:${{ steps.version.outputs.value }} -f ${{ vars.DOCKER_FILE }} .
          docker push projectname.azurecr.io/${{ vars.IMAGE_NAME }}:${{ steps.version.outputs.value }}

[anmelegov]

Looks like that it is not possible yet. I decided to pass Personal Access Token to a repository secrets

[rowanfreeman-acutro]

This worked for me. I have a .NET application that references a NuGet package that is hosted in the same organisation but different repository.

Go to your org's package settings. Should be https://github.com/orgs/<Organisation>/packages/nuget/<PackageId>/settings.
Then under Manage Actions access, add the repository(ies) that need access to the package. Read access is fine.

For your application, make sure it has a nuget.config file at the root.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <packageSources>
        <add key="github" value="https://nuget.pkg.github.com/<Organisation>/index.json"/>
    </packageSources>
</configuration>

Then, for your application's workflow, use the NuGetPackageSourceCredentials_<key> environment variable.

Example:

jobs:
  build:
    name: Build and test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 8.0.x

      - name: Build
        run: dotnet build --configuration Release
        env:
          NuGetPackageSourceCredentials_github: Username=${{ github.actor }};Password=${{ secrets.GITHUB_TOKEN }}

      - name: Test
        run: dotnet test --configuration Release --no-build

[mz-tools]

FWIW, the Username can be anything (such as "DUMMY_USER"), not necessarily =${{ github.actor }}

Another approach, if you don't want the NuGet.config in the repo (*) and feel nervous about the "github" matching name in two different files, is to add the NuGet feed before restoring packages:

jobs:

  build:

    runs-on: ubuntu-latest
    
    env:
      NUGET_FEED_NAME: github
      NUGET_FEED_URL: https://nuget.pkg.github.com/<org>/index.json

    steps:

      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Configure Nuget feed
        run: dotnet nuget add source --name ${{ env.NUGET_FEED_NAME }} ${{ env.NUGET_FEED_URL }}

      - name: Install dependencies
        run: dotnet restore
        env:
          NuGetPackageSourceCredentials_${{ env.NUGET_FEED_NAME }}: Username=DUMMY_USER;Password=${{ secrets.GITHUB_TOKEN }}

      - name: Build
        run: dotnet build --configuration Release --no-restore
     ...

(*) Visual Studio in local computer will have in the Options window, NuGet Package Manager section, the NuGet feed for https://nuget.pkg.github.com//index.json (with your own personal credentials when asked), so there is no need for NuGet.config in the repo.