From 0767820ac277010aaf0ed3935c71e0b2d859bf94 Mon Sep 17 00:00:00 2001
From: monsieurleberre <monsieurleberre@users.noreply.github.com>
Date: Thu, 11 Jun 2026 16:31:31 +0200
Subject: [PATCH 1/3] ci: grant id-token: write for NuGet trusted publishing

The shared csharp-publish-public.yaml@v1 now mints a short-lived
nuget.org key via OIDC (NuGet/login). The calling job must grant
id-token: write or the OIDC token request fails.
---
 .github/workflows/publish.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 714d6b0..0a9a77b 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -12,6 +12,9 @@ on:
 
 jobs:
   publish:
+    permissions:
+      contents: read
+      id-token: write
     uses: peacefulstudio/github-actions/.github/workflows/csharp-publish-public.yaml@v1
     secrets: inherit
     with:

From 89bd013efb3ba3a6937dad4a85d1ad6be8cbc4c7 Mon Sep 17 00:00:00 2001
From: monsieurleberre <monsieurleberre@users.noreply.github.com>
Date: Thu, 11 Jun 2026 17:04:58 +0200
Subject: [PATCH 2/3] ci: reshape publish.yaml to inline composite action for
 trusted publishing

Mint the OIDC token in this publish.yaml job via NuGet/login with
id-token: write, so job_workflow_ref resolves to
dotnet-extensions/.github/workflows/publish.yaml (the nuget.org
Trusted Publishing policy anchor). The heavy lifting moves to the
csharp-publish composite action invoked as an inline step, which does
not change job_workflow_ref.
---
 .github/workflows/publish.yaml | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 0a9a77b..5871202 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -12,10 +12,23 @@ on:
 
 jobs:
   publish:
+    runs-on: ubuntu-latest
+    environment: nuget-publish
     permissions:
       contents: read
       id-token: write
-    uses: peacefulstudio/github-actions/.github/workflows/csharp-publish-public.yaml@v1
-    secrets: inherit
-    with:
-      version_override: ${{ inputs.version_override }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: NuGet login (OIDC -> short-lived key)
+        id: login
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
+        with:
+          user: ${{ secrets.NUGET_USER }}
+      - name: Build, test, pack & push
+        uses: peacefulstudio/github-actions/.github/actions/csharp-publish@feat/csharp-publish-composite-action
+        with:
+          api-key: ${{ steps.login.outputs.NUGET_API_KEY }}
+          version_override: ${{ inputs.version_override }}

From b7256b8726c14d2e2a2b1bb4105460ffba28190e Mon Sep 17 00:00:00 2001
From: monsieurleberre <monsieurleberre@users.noreply.github.com>
Date: Thu, 11 Jun 2026 18:17:24 +0200
Subject: [PATCH 3/3] ci: point csharp-publish composite action at stable @v1

---
 .github/workflows/publish.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 5871202..4e4e6fb 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -28,7 +28,7 @@ jobs:
         with:
           user: ${{ secrets.NUGET_USER }}
       - name: Build, test, pack & push
-        uses: peacefulstudio/github-actions/.github/actions/csharp-publish@feat/csharp-publish-composite-action
+        uses: peacefulstudio/github-actions/.github/actions/csharp-publish@v1
         with:
           api-key: ${{ steps.login.outputs.NUGET_API_KEY }}
           version_override: ${{ inputs.version_override }}