From b0186d19922752671c83887ccf6ab8b594b28076 Mon Sep 17 00:00:00 2001
From: Chris Mitchell <chris.mitchell@xero.com>
Date: Mon, 10 Aug 2026 15:27:30 +1200
Subject: [PATCH] [XAPI-2340] Switch NuGet publishing to Trusted Publishing
 (OIDC)

Replaces the long-lived NUGET_APIKEY secret with NuGet's Trusted
Publishing flow (NuGet/login@v1 + id-token: write) for both the
OAuth2 and OAuth2Client publish workflows. The OAuth2Client publish
has been failing with a 403 since 2026-07-14, likely because the
API key's package scope doesn't cover Xero.NetStandard.OAuth2Client;
Trusted Publishing removes the scoping problem and the long-lived
secret entirely.
---
 .github/workflows/publish-Oauth2-package.yml       |  9 ++++++++-
 .github/workflows/publish-Oauth2Client-package.yml | 10 +++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-Oauth2-package.yml b/.github/workflows/publish-Oauth2-package.yml
index 0c648431..555b0e2d 100644
--- a/.github/workflows/publish-Oauth2-package.yml
+++ b/.github/workflows/publish-Oauth2-package.yml
@@ -18,6 +18,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      id-token: write
 
     steps:
 
@@ -53,8 +54,14 @@ jobs:
       run: dotnet pack
       working-directory: Xero-NetStandard
 
+    - name: NuGet login (OIDC -> temp API key)
+      uses: NuGet/login@v1
+      id: nuget_login
+      with:
+        user: ${{ vars.NUGET_USER }}
+
     - name: Publish OAuth2 Package to Nuget.org
-      run: dotnet nuget push ./Xero.NetStandard.OAuth2/bin/Release/Xero.NetStandard.OAuth2.${{steps.get_latest_release_number.outputs.release_tag}}.nupkg --api-key ${{ secrets.NUGET_APIKEY }} --source https://api.nuget.org/v3/index.json
+      run: dotnet nuget push ./Xero.NetStandard.OAuth2/bin/Release/Xero.NetStandard.OAuth2.${{steps.get_latest_release_number.outputs.release_tag}}.nupkg --api-key ${{ steps.nuget_login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json
       working-directory: Xero-NetStandard
 
   notify-codegen-repo:
diff --git a/.github/workflows/publish-Oauth2Client-package.yml b/.github/workflows/publish-Oauth2Client-package.yml
index b46c7b22..39697d7b 100644
--- a/.github/workflows/publish-Oauth2Client-package.yml
+++ b/.github/workflows/publish-Oauth2Client-package.yml
@@ -21,6 +21,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      id-token: write
 
     steps:
 
@@ -141,9 +142,16 @@ jobs:
       run: dotnet pack ./Xero.NetStandard.OAuth2Client/Xero.NetStandard.OAuth2Client.csproj
       working-directory: Xero-NetStandard
 
+    - name: NuGet login (OIDC -> temp API key)
+      if: steps.check_changes.outputs.has_changes == 'true'
+      uses: NuGet/login@v1
+      id: nuget_login
+      with:
+        user: ${{ vars.NUGET_USER }}
+
     - name: Publish OAuth2Client Package to Nuget.org
       if: steps.check_changes.outputs.has_changes == 'true'
-      run: dotnet nuget push ./Xero.NetStandard.OAuth2Client/bin/Release/Xero.NetStandard.OAuth2Client.${{steps.calc_version.outputs.version}}.nupkg --api-key ${{ secrets.NUGET_APIKEY }} --source https://api.nuget.org/v3/index.json
+      run: dotnet nuget push ./Xero.NetStandard.OAuth2Client/bin/Release/Xero.NetStandard.OAuth2Client.${{steps.calc_version.outputs.version}}.nupkg --api-key ${{ steps.nuget_login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json
       working-directory: Xero-NetStandard
 
     - name: Commit, Push and Tag