From b493cdb5b0dbdf7365d8544e7733216e608367ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marvin=20R=C3=BChe?=
 <471338+Marv51@users.noreply.github.com>
Date: Thu, 4 Dec 2025 20:50:18 +0100
Subject: [PATCH] Publish to nuget.org with trusted publishing

---
 .github/workflows/CD.yml | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/CD.yml b/.github/workflows/CD.yml
index 54aa4c43..e4f8b487 100644
--- a/.github/workflows/CD.yml
+++ b/.github/workflows/CD.yml
@@ -14,6 +14,7 @@ jobs:
     permissions:
       packages: write
       contents: read
+      id-token: write  # enable GitHub OIDC token issuance for this job
 
     steps:
       - name: Checkout
@@ -46,8 +47,20 @@ jobs:
           path: |
             ${{ github.workspace }}/src/CsvHelper/bin/Release/*.nupkg
 
-      - name: Prep packages
-        run: dotnet nuget add source --username marv51 --password ${{ secrets.GITHUB_TOKEN }} --store-password-in-clear-text --name github "https://nuget.pkg.github.com/marv51/index.json"
+      # Get a short-lived NuGet API key
+      - name: NuGet login (OIDC -> temp API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
+
+          # Push the package
+      - name: NuGet push
+        run: dotnet nuget push src/CsvHelper/bin/Release/*.nupkg --api-key ${{steps.login.outputs.NUGET_API_KEY}} --source https://api.nuget.org/v3/index.json
+
+     # - name: Prep packages
+     #   run: dotnet nuget add source --username marv51 --password ${{ secrets.GITHUB_TOKEN }} --store-password-in-clear-text --name github "https://nuget.pkg.github.com/marv51/index.json"
 
-      - name: Push package to GitHub packages 
-        run: dotnet nuget push src/CsvHelper/bin/Release/*.nupkg --api-key ${{ secrets.GITHUB_TOKEN }}  --source "github"
\ No newline at end of file
+     # - name: Push package to GitHub packages 
+     #   run: dotnet nuget push src/CsvHelper/bin/Release/*.nupkg --api-key ${{ secrets.GITHUB_TOKEN }}  --source "github"
\ No newline at end of file