nuget-trusted-publishing

by dotnet5.7k

Install

The skill file stays in the publisher's repository.

Paste the copied command in a terminal. It installs this SKILL.md into that agent.

npx skills add dotnet/skills --skill nuget-trusted-publishing -a cursor -y

Download skill plugins/dotnet-advanced/skills/nuget-trusted-publishing/SKILL.md on GitHub

Related skills

View all

Questions

How do I install nuget-trusted-publishing?: Download plugins/dotnet-advanced/skills/nuget-trusted-publishing/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does nuget-trusted-publishing live?: The publisher keeps it at https://github.com/dotnet/skills.
Which agents can use nuget-trusted-publishing?: Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.

name: nuget-trusted-publishing description: > Set up NuGet trusted publishing (OIDC) on a GitHub Actions repo — replaces long-lived API keys with short-lived tokens. USE FOR: trusted publishing, NuGet OIDC, keyless NuGet publish, migrate from NuGet API key, NuGet/login, secure NuGet publishing. DO NOT USE FOR: publishing to private feeds or Azure Artifacts (OIDC is nuget.org only). INVOKES: shell (powershell or bash), edit, create, ask_user for guided repo setup. license: MIT

NuGet Trusted Publishing Setup

Set up NuGet trusted publishing on a GitHub Actions repo. Replaces long-lived API keys with OIDC-based short-lived tokens — no secrets to rotate or leak.

Prerequisites

GitHub Actions — this skill covers GitHub Actions setup only

Type	Required
All	`PackageId`, `Version` (in .csproj or Directory.Build.props)
Dotnet tool	`PackAsTool` (required); `ToolCommandName` (optional but recommended — defaults to assembly name)
MCP server	`PackageType=McpServer`, `.mcp/server.json` included in package
Template	`PackageType=Template`, `.template.config/template.json` under content dir

Problem	Cause	Fix
`NuGet/login` 403	Missing `id-token: write`	Add to job permissions
"no matching policy"	Workflow filename mismatch	Verify exact filename on nuget.org
Push unauthorized	Package not owned by policy account	Check policy owner on nuget.org
Token expired	Login step >1hr before push	Move `NuGet/login` closer to push
"temporarily active" policy	Private repo, first publish pending	Publish within 7 days
`already_exists` on push	Re-running same version	Add `--skip-duplicate`
GitHub Release 422	Duplicate release for tag	Delete conflicting release (confirm first)
Re-run uses wrong YAML	`gh run rerun` replays original commit's YAML	Delete obstacle, re-run — never re-tag

nuget-trusted-publishing

Install

Related skills

Questions

NuGet Trusted Publishing Setup

Prerequisites

When to Use This Skill

Safety Rules

Process

Phase 1: Assess

Phase 2: Local Verification

Phase 3: nuget.org Policy

Phase 4: Workflow Setup

Troubleshooting

References