Skip to content

Use NuGet/login in CI and bump dependencies #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dsanchezcr merged 5 commits into from
Feb 20, 2026
Merged

Use NuGet/login in CI and bump dependencies #41

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c97078c
Use NuGet/login in CI and bump dependencies
dsanchezcr Feb 20, 2026
d6e5414
Merge branch 'main' into improvements
dsanchezcr Feb 20, 2026
3bc376f
Initial plan
Copilot Feb 20, 2026
228ca8e
Downgrade xunit.runner.visualstudio 3.1.5 → 2.8.2 to match xunit 2.9.3
Copilot Feb 20, 2026
227ca1b
Merge pull request #42 from dsanchezcr/copilot/sub-pr-41
dsanchezcr Feb 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,9 @@ on:
paths-ignore:
- '.github/**'
workflow_dispatch:

permissions: read-all

Comment on lines +13 to +14
Copy link

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

permissions: read-all at the workflow level is redundant here because the analyze job defines its own explicit permissions block (which overrides the workflow-level setting). Keeping read-all also increases the default token scope for any future jobs added without explicit permissions; consider removing the workflow-level read-all and relying on the job’s least-privilege permissions instead.

Suggested change
permissions: read-all

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Owner Author

@dsanchezcr dsanchezcr Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot removing permissions will cause CodeQL can't run the static analysis.

jobs:
analyze:
name: Analyze
Expand Down
15 changes: 7 additions & 8 deletions .github/workflows/workflow.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,15 +88,13 @@ jobs:
uses: actions/setup-dotnet@v5
with:
dotnet-version: '10.0.x'
- name: Get NuGet OIDC token
id: nuget-oidc
run: |
token=$(curl -sS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
"${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=api://NuGetTrustedPublisher" | jq -r '.value')
echo "::add-mask::$token"
echo "token=$token" >> "$GITHUB_OUTPUT"
- name: NuGet Trusted Publishing login
uses: NuGet/login@v1
id: nuget-login
with:
user: dsanchezcr
- name: Publish to NuGet.org
run: dotnet nuget push **/*.nupkg --skip-duplicate --source https://api.nuget.org/v3/index.json --api-key ${{ steps.nuget-oidc.outputs.token }}
run: dotnet nuget push **/*.nupkg --skip-duplicate --source https://api.nuget.org/v3/index.json --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
- name: Authenticating to GitHub Packages
run: dotnet nuget add source --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }} --store-password-in-clear-text --name github "https://nuget.pkg.github.com/dsanchezcr/index.json"
- name: Publish to GitHub Packages
Expand All @@ -111,6 +109,7 @@ jobs:
permissions:
contents: read
id-token: write
packages: write
steps:
- uses: actions/checkout@v6
- name: Set up Node.js for npmjs.com
Expand Down
2 changes: 1 addition & 1 deletion src/NuGet/ColonesExchangeRate.Tests/ColonesExchangeRate.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
<PrivateAssets>all</PrivateAssets>
</PackageReference>
<PackageReference Include="coverlet.collector" Version="6.0.4">
<PackageReference Include="coverlet.collector" Version="8.0.0">
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
<PrivateAssets>all</PrivateAssets>
</PackageReference>
Expand Down
2 changes: 1 addition & 1 deletion src/NuGet/ColonesExchangeRate/ColonesExchangeRate.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,6 @@
</None>
</ItemGroup>
<ItemGroup>
<PackageReference Include="System.Text.Json" Version="8.0.6" />
<PackageReference Include="System.Text.Json" Version="10.0.3" />
</ItemGroup>
</Project>
Loading