[icnocop]

Addresses the workflow part of #1128.

Note

This branch is based on #1127 (which also changes Build and Publish.yml), so it includes that PR's commit until #1127 is merged. Only the last commit (Use nuget.org Trusted Publishing in Build and Publish workflow) belongs to this PR.

Changes

Replaces the long-lived NUGET_API_KEY secret with nuget.org Trusted Publishing:

• The Publish job gets id-token: write so it can request a GitHub OIDC token, and contents: write, which is still needed to create the GitHub release (an explicit permissions block replaces the job's default token permissions).
• A NuGet/login@v1 step exchanges the OIDC token for a short-lived nuget.org API key.
• The key is passed to the Build step as NUGET_API_KEY, the variable the Nuke PublishPackages target already reads, so nuke/Build.cs is unchanged.
• The workflow-level NUGET_API_KEY secret reference is removed.

Required setup before merging

1. On nuget.org, signed in as the owner of the ElectronNET.Core* packages: username → Trusted Publishing → add a GitHub Actions policy:
   • Repository Owner: ElectronNET
   • Repository: Electron.NET
   • Workflow File: Build and Publish.yml
   • Environment: (leave empty)
2. Add a repository secret NUGET_USER containing the nuget.org profile name (not email) of that policy owner.

After a successful publish, the old NUGET_API_KEY repository secret can be deleted.

[GregorBiswanger]

NuGet Trusted Publishing is configured on nuget.org for ElectronNET/Electron.NET → Build and Publish.yml, scoped to new versions of existing ElectronNET.Core* packages. NUGET_USER was already present in the repository. PR #1129 was merged as 4eeb98a; the workflow now exchanges GitHub OIDC for a short-lived NuGet key via NuGet/login@v1.

Post-merge validation on develop has not reached the publish step: run #175 failed its Integration-Tests gate (88 Electron startup timeouts on ubuntu-24.04/Electron 30.4.0, one macOS 26 test failure, and unsupported macos-14 runner configuration). The retry also left the gate failed, so Publish was skipped and no package was published. The existing NUGET_API_KEY secret remains until a successful Trusted Publishing publish is verified.

Run: https://github.com/ElectronNET/Electron.NET/actions/runs/42874033087