From 8123a503ca3b3f13ea0bf2fb7a065da9668ce1d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Seguin?= <sseguin@luccasoftware.com>
Date: Tue, 9 Jun 2026 16:22:31 +0200
Subject: [PATCH 1/3] Update NuGet push process with OIDC login

---
 .github/workflows/dotnetcore.yml | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dotnetcore.yml b/.github/workflows/dotnetcore.yml
index 335d167..9e72c24 100644
--- a/.github/workflows/dotnetcore.yml
+++ b/.github/workflows/dotnetcore.yml
@@ -64,9 +64,14 @@ jobs:
     - name: Pack MerQure.Tools
       run: dotnet pack src\MerQure.Tools\MerQure.Tools.csproj --configuration Release -o artifacts -p:PackageVersion=${{ steps.gitversion.outputs.nuGetVersionV2 }}
 
-    - name: Nuget org push
-      if: startsWith(github.ref, 'refs/tags/')
-      run: dotnet nuget push "artifacts/**/*.nupkg" --skip-duplicate --source https://api.nuget.org/v3/index.json -k ${{ secrets.GLOBAL_NUGET_PUBLISH }}
-      env:
-        NUGET_PUBLISH: ${{ secrets.NUGET_PUBLISH }}
+    # https://learn.microsoft.com/fr-fr/nuget/nuget-org/trusted-publishing
+    - name: NuGet login (OIDC → temp API key)
+      uses: NuGet/login@v1
+      id: login
+      with:
+        user: ${{ secrets.NUGET_USER }}
+    
+    # Push the package
+    - name: NuGet push
+      run: dotnet nuget push "artifacts/**/*.nupkg" --skip-duplicate --source https://api.nuget.org/v3/index.json --api-key ${{steps.login.outputs.NUGET_API_KEY}} 
          

From e2b312622e7f98feb84665fd98b9bcc55e9babc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Seguin?= <sseguin@luccasoftware.com>
Date: Tue, 9 Jun 2026 16:30:10 +0200
Subject: [PATCH 2/3] Update GitHub Actions workflow for .NET Core

---
 .github/workflows/dotnetcore.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dotnetcore.yml b/.github/workflows/dotnetcore.yml
index 9e72c24..5df8d3c 100644
--- a/.github/workflows/dotnetcore.yml
+++ b/.github/workflows/dotnetcore.yml
@@ -6,6 +6,9 @@ on:
     branches:
       - master
   pull_request:
+permissions:
+  id-token: write
+  contents: read
 
 jobs:
   build:
@@ -66,7 +69,7 @@ jobs:
 
     # https://learn.microsoft.com/fr-fr/nuget/nuget-org/trusted-publishing
     - name: NuGet login (OIDC → temp API key)
-      uses: NuGet/login@v1
+      uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 #v1.2.0
       id: login
       with:
         user: ${{ secrets.NUGET_USER }}

From 916623a2423f5f05fab830cad4d6d2ff6b15e298 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Seguin?= <sseguin@luccasoftware.com>
Date: Tue, 9 Jun 2026 16:48:06 +0200
Subject: [PATCH 3/3] Update dotnetcore.yml

---
 .github/workflows/dotnetcore.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/dotnetcore.yml b/.github/workflows/dotnetcore.yml
index 5df8d3c..1ee6f3b 100644
--- a/.github/workflows/dotnetcore.yml
+++ b/.github/workflows/dotnetcore.yml
@@ -6,13 +6,13 @@ on:
     branches:
       - master
   pull_request:
-permissions:
-  id-token: write
-  contents: read
 
 jobs:
   build:
     runs-on: windows-latest
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
     - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2