publish nuget packages using Trusted Publishing

[arturcic]

uses OIDC token exchange for nuget api key retrieval, instead of storing the api key in github secrets.

[Copilot]

Pull Request Overview

This PR migrates NuGet package publishing from using a static API key secret to GitHub OIDC token-based authentication. This improves security by eliminating the need to store long-lived credentials.

• Implements OIDC token exchange flow for NuGet.org authentication
• Removes the NUGET_API_KEY secret dependency from the workflow
• Converts the publish task to async to support the OIDC token retrieval

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
build/publish/Tasks/PublishNuget.cs	Adds OIDC token exchange logic and converts task to async
.github/workflows/_publish.yml	Removes NUGET_API_KEY secret reference

Comments suppressed due to low confidence (1)

.github/workflows/_publish.yml:11

• Missing required permissions for OIDC token access. The workflow needs permissions: id-token: write to allow the publish job to retrieve GitHub OIDC tokens. Add a permissions section to the publish job with id-token: write.

  publish:
    name: ${{ matrix.taskName }}
    runs-on: windows-2025

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
5 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mergify]

Thank you @arturcic for your contribution!

[gittools-bot]

🎉 This issue has been resolved in version 6.5.0 🎉
The release is available on:

• GitHub Release
• Chocolatey Package
• .Net Global Tool

Your GitReleaseManager bot 📦🚀