Merge pull request #372 from BUTR/trusted-publishing

ci: switch NuGet publishing to Trusted Publishing (OIDC)

Author: Aragas

.github/workflows/publish-nuget.yml

@@ -9,6 +9,11 @@ on:
       - 'src/Bannerlord.ModuleManager/**.cs'
   workflow_dispatch:
 
+permissions:
+  id-token: write
+  contents: read
+  packages: write
+
 jobs:
   publish:
     name: Publish on NuGet and GPR
@@ -29,8 +34,14 @@ jobs:
 
       - run: dotnet pack -c Release src/Bannerlord.ModuleManager.Source -p:VersionOverride=$(git rev-list --no-merges --count master) -o ./packages
 
+      - name: NuGet login (trusted publishing)
+        uses: NuGet/login@v1
+        id: nuget-login
+        with:
+          user: Aragas
+
       - name: Push to NuGet
-        run: dotnet nuget push "./packages/*.nupkg" -k ${{secrets.NUGET_API_KEY}} -s https://www.nuget.org --skip-duplicate
+        run: dotnet nuget push "./packages/*.nupkg" -k ${{ steps.nuget-login.outputs.NUGET_API_KEY }} -s https://www.nuget.org --skip-duplicate
         shell: pwsh
 
       - name: Push to GPR