# Nuget Trusted Publishing

Set up NuGet trusted publishing (OIDC) on a GitHub Actions repo, replaces long-lived...

- Repository: https://github.com/dotnet/skills (5787 stars)
- Category: DevOps
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add dotnet/skills --skill nuget-trusted-publishing -g -a claude-code -y`
Codex: `npx skills add dotnet/skills --skill nuget-trusted-publishing -g -a codex -y`
Cursor: `npx skills add dotnet/skills --skill nuget-trusted-publishing -g -a cursor -y`
Gemini CLI: `npx skills add dotnet/skills --skill nuget-trusted-publishing -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add dotnet/skills`

## Description

Set up NuGet trusted publishing (OIDC) on a GitHub Actions repo, replaces long-lived API keys with short-lived tokens. USE FOR: trusted publishing, NuGet OIDC, keyless NuGet publish, migrate from NuGet API key, NuGet/login, secure NuGet publishing. DO NOT USE FOR: publishing to private feeds or Azure Artifacts (OIDC is nuget.org only). INVOKES: shell (powershell or bash), edit, create, ask_user for guided repo setup.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# NuGet Trusted Publishing Setup

Set up [NuGet trusted publishing](https://learn.microsoft.com/en-us/nuget/nuget-org/trusted-publishing) on a GitHub Actions repo. Replaces long-lived API keys with OIDC-based short-lived tokens, no secrets to rotate or leak.

## Prerequisites

- **GitHub Actions**, this skill covers GitHub Actions setup only
- **nuget.org account**, the user needs access to create trusted publishing policies

## When to Use This Skill

Use this skill when:
- Setting up trusted publishing for a NuGet package
- Migrating from `secrets.NUGET_API_KEY` to OIDC-based publishing
- Asked about keyless or secure NuGet publishing
- Creating a new NuGet publish workflow from scratch
- Asked to "remove NuGet API key" or "use NuGet/login"
- Setting up publishing for a dotnet tool, MCP server, or template package
- Asked about `NuGet/login@v1` or `id-token: write`

## Safety Rules

> ⚠️ **Bail-out rule**: If any phase fails after one fix attempt on an infrastructure/auth issue, stop and ask the user. Don't loop on environment problems.

> ⚠️ **Never delete or overwrite without confirmation**: Removing API key secrets, deleting tags/releases, removing workflow steps, or changing package IDs. NuGet package IDs are permanent, mistakes can't be undone.

## Process

> **Fast-path for greenfield repos**: When the user has a simple setup (one packable project, no existing publish workflow), don't gate on multi-turn assessment. Combine phases: create the workflow immediately, include nuget.org policy guidance, local pack recommendation, and filename-matching warning all in one response. The full phased process below is for complex or migration scenarios.

### Phase 1: Assess

Inspect the repo and report findings before making any changes.

The rest: https://github.com/dotnet/skills/blob/HEAD/plugins/dotnet-advanced/skills/nuget-trusted-publishing/SKILL.md