From 73bc1005618eb8d20ce0ae811be2f3c81075eea4 Mon Sep 17 00:00:00 2001
From: Louis Zanella <louis.zanella@ubisoft.com>
Date: Mon, 2 Nov 2026 09:16:37 -0500
Subject: [PATCH 1/2] ci: Replace nuget.org API key with OIDC Trusted
 Publishing

---
 .github/workflows/ci.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5dc13ea0..8b36f6e3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
     needs: [create_nuget, build_and_test]
     permissions:
       contents: read
-      packages: write
+      id-token: write
     steps:
       - uses: actions/download-artifact@v8
         with:
@@ -115,6 +115,12 @@ jobs:
         uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
+      - name: NuGet login (OIDC)
+        id: nuget-login
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: NuGet/login@v1
+        with:
+          user: ${{secrets.NUGET_USER}}
       - name: Publish NuGet packages
         run: |
           Write-Host "Current ref: $env:GITHUB_REF"
@@ -124,7 +130,7 @@ jobs:
               if ($env:GITHUB_REF -clike 'refs/tags/*')
               {
                 Write-Host "Pushing NuGet package: $($file.FullName)"
-                & dotnet nuget push "$($file.FullName)" --api-key "${{secrets.NUGET_APIKEY}}" --source https://api.nuget.org/v3/index.json --force-english-output --skip-duplicate
+                & dotnet nuget push "$($file.FullName)" --api-key "${{steps.nuget-login.outputs.NUGET_API_KEY}}" --source https://api.nuget.org/v3/index.json --force-english-output --skip-duplicate
               }
               else
               {

From 55e72f49ecac6cd02c37d872f47961e6193b7185 Mon Sep 17 00:00:00 2001
From: Louis Zanella <louis.zanella@ubisoft.com>
Date: Mon, 2 Nov 2026 14:09:31 -0500
Subject: [PATCH 2/2] Add comment

---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8b36f6e3..e2491404 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -115,6 +115,10 @@ jobs:
         uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
+      # If this is a tag build, log in to NuGet using OIDC. For this to work,
+      # - One of the ubisoft-square organization (https://www.nuget.org/profiles/ubisoft-square) admin user accounts
+      #   was used to set up a Trusted Publishing (https://www.nuget.org/account/trustedpublishing)
+      # - NUGET_USER was set as an Actions repository secret (https://github.com/ubisoft/NGitLab/settings/secrets/actions) to that admin's username
       - name: NuGet login (OIDC)
         id: nuget-login
         if: startsWith(github.ref, 'refs/tags/')