From 5a764e6ba45300212c9df124efcbdd88fa96a25e Mon Sep 17 00:00:00 2001
From: "M.P. Korstanje" <rien.korstanje@gmail.com>
Date: Wed, 6 May 2026 19:25:33 +0200
Subject: [PATCH] Use Trusted Publishing for NuGet

---
 .github/workflows/release-nuget.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release-nuget.yaml b/.github/workflows/release-nuget.yaml
index 911d812e..719a4cd2 100644
--- a/.github/workflows/release-nuget.yaml
+++ b/.github/workflows/release-nuget.yaml
@@ -20,7 +20,12 @@ jobs:
       - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           dotnet-version: 8.0.x
+      - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
+        id: login
+        with:
+          user: ${{ secrets.NUGET_USER }}
       - uses: cucumber/action-publish-nuget@f059d15b2dbcd962afc0d29424f4f083177255aa # v1.0.0
         with:
-          nuget-api-key: ${{ secrets.NUGET_API_KEY }}
+          nuget-api-key: ${{ steps.login.outputs.NUGET_API_KEY }}
           working-directory: "dotnet"