nuget-trusted-publishing
Set up NuGet trusted publishing (OIDC) on a GitHub Actions repo — replaces long-lived API keys with short-lived tokens. USE FOR: trusted publishing, NuGet OIDC, keyless NuGet publish, migrate from NuGet API key, NuGet/login, secure NuGet publishing. DO NOT USE FOR: publishing to private feeds or Azure Artifacts (OIDC is nuget.org only).
npx skills add dotnet/skills --skill nuget-trusted-publishing --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# NuGet Trusted Publishing Setup Set up [NuGet trusted publishing](https://learn.microsoft.com/en-us/nuget/nuget-org/trusted-publishing) on a GitHub Actions repo. Replaces long-lived API keys with OIDC-based short-lived tokens — no secrets to rotate or leak. ## Prerequisites - **GitHub Actions** — this skill covers GitHub Actions setup only - **nuget.org account** — the user needs access to create trusted publishing policies ## When to Use This Skill Use this skill when: - Setting up trusted publishing for a NuGet package - Migrating from `secrets.NUGET_API_KEY` to OIDC-based publishing - Asked about keyless or secure NuGet publishing - Creating a new NuGet publish workflow from scratch - Asked to "remove NuGet API key" or "use NuGet/login" - Setting up publishing for a dotnet tool, MCP server, or template package - Asked about `NuGet/login@v1` or `id-token: write` ## Safety Rules > ⚠️ **Bail-out rule**: If any phase fails after one fix attempt on an infrastructure/auth issue, stop and ask the user. Don't loop on environment problems. > ⚠️ **Never delete or overwrite without confirmation**: Removing API key secrets, deleting tags/releases, removing workflow steps, or changing packa
- Prerequisites
- When to Use This Skill
- Safety Rules
- Process
- Phase 1: Assess
- Phase 2: Local Verification
- Phase 3: nuget.org Policy
- Phase 4: Workflow Setup
- Troubleshooting
- References
What does the nuget-trusted-publishing skill do?
Set up NuGet trusted publishing (OIDC) on a GitHub Actions repo — replaces long-lived API keys with short-lived tokens. USE FOR: trusted publishing, NuGet OIDC, keyless NuGet publish, migrate from NuGet API key, NuGet/login, secure NuGet publishing. DO NOT USE FOR: publishing to private feeds or Azure Artifacts (OIDC is nuget.org only).
How do I install it?
Run `npx skills add dotnet/skills --skill nuget-trusted-publishing --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From dotnet/skills, a repository with 4,927 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.