[Lakritzator]

Summary

• The release job gets id-token: write, so it can request a GitHub OIDC token.
• A new NuGet/login@v1 step (user Lakritzator) exchanges that token for a short-lived nuget.org API key.
• Push to NuGet uses that key. If the login fails (e.g. no policy yet), it falls back to the NUGET_API_KEY secret.

Setup

1. nuget.org trusted publishing policy: owner dapplo, repository Dapplo.Windows, workflow file build.yml, environment NuGet.
2. Once a release has gone through this way, the NUGET_API_KEY secret can be removed.

https://claude.ai/code/session_017qu4NGxUZizEKzrG8d2DGY

---

Generated by Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coveralls]

Coverage Report for CI Build 41445986540

Warning

Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes.
Quick fix: rebase this PR. Learn more →

Coverage remained the same at 54.23%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	11410
Covered Lines:	6393
Line Coverage:	56.03%
Relevant Branches:	6272
Covered Branches:	3196
Branch Coverage:	50.96%
Branches in Coverage %:	Yes
Coverage Strength:	1038.48 hits per line

---

💛 - Coveralls