Skip to content

Publish NuGet packages to nuget.org (trusted publishing) + release 1.0.5 - #2

Merged
rvegajr merged 2 commits into
mainfrom
ci/nuget-trusted-publishing
Sep 30, 2026
Merged

rvegajr merged 2 commits into
mainfrom
ci/nuget-trusted-publishing

Conversation

@rvegajr

@rvegajr rvegajr commented Sep 30, 2026

Copy link
Copy Markdown
Member

What

  • v* tags now publish the eight embeddable packages to nuget.org, as well as GitHub Packages. Before this, they were only on GitHub Packages, which requires a token even to install public packages.
  • Authentication uses nuget.org trusted publishing: GitHub OIDC through NuGet/login@v1, with user: rvegajr. No API key is stored anywhere. Only the publish-nuget job gets id-token: write.
  • chore(release): 1.0.5 bumps Directory.Build.props and js/package.json, the same way 1.0.3 and 1.0.4 were released.

Package contents

Unchanged from 1.0.4: this PR touches no source under src/. Pushes use --skip-duplicate, so re-running a release is safe.

Before tagging v1.0.5

This requires a nuget.org trusted publishing policy:

  • owner rvegajr
  • repo YOLOVibeCode/ez-odata-api
  • workflow ci.yml
  • packages EzOdata.Core, EzOdata.Connectors.*, EzOdata.OData, EzOdata.Rest, EzOdata.Docs, EzOdata.Embedded, EzOdata.AspNetCore, EzOdata.WebApi

As with every v* tag, the release also publishes npm 1.0.5.

v* tags now push the embeddable packages to nuget.org as well as GitHub
Packages. Authentication uses nuget.org trusted publishing (GitHub OIDC via
NuGet/login), so no API key is stored in the repository.
@rvegajr
rvegajr merged commit 091f62d into main Sep 30, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant