From ae986065bf2897d1a9ec11bfc4de8a11745d3535 Mon Sep 17 00:00:00 2001
From: "Dixon, Evan" <edixon@mimeo.com>
Date: Thu, 23 Jul 2026 10:53:34 -0500
Subject: [PATCH 1/3] Use trusted publishing

---
 .github/workflows/build.yml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 94a1cff..110f87a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -81,6 +81,8 @@ jobs:
   publish-nuget:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # enable GitHub OIDC token issuance for this job
 
     # Only run for main branch
     if: github.ref == 'refs/heads/main'
@@ -98,7 +100,11 @@ jobs:
         name: nuget
         path: nuget
 
+    - name: NuGet login (OIDC → temp API key)
+      uses: NuGet/login@v1
+      id: login
+      with:
+        user: ${{ secrets.NUGET_USER }}
+
     - name: Upload Packages
-      env:
-        NUGET_API_KEY: ${{ secrets.NUGET_MIMEO_PUBLISH_KEY }}
-      run: dotnet nuget push ./nuget/*.nupkg --source https://api.nuget.org/v3/index.json --skip-duplicate --api-key $NUGET_API_KEY
+      run: dotnet nuget push ./nuget/*.nupkg --source https://api.nuget.org/v3/index.json --skip-duplicate --api-key ${{steps.login.outputs.NUGET_API_KEY}}

From 6c7c88168631c98cdfac205ea56c11571dbef9e7 Mon Sep 17 00:00:00 2001
From: "Dixon, Evan" <edixon@mimeo.com>
Date: Thu, 23 Jul 2026 10:56:01 -0500
Subject: [PATCH 2/3] Test nuget publish outside main

---
 .github/workflows/build.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 110f87a..2bfb341 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -85,7 +85,9 @@ jobs:
       id-token: write  # enable GitHub OIDC token issuance for this job
 
     # Only run for main branch
-    if: github.ref == 'refs/heads/main'
+    #if: github.ref == 'refs/heads/main'
+    #Temporarily changed to all branches for testing
+    if: github.event_name != 'pull_request' && github.event_name != 'create'
 
     steps:
 

From f71c7e29cd99966a79f790dfef05e524217a137e Mon Sep 17 00:00:00 2001
From: "Dixon, Evan" <edixon@mimeo.com>
Date: Thu, 23 Jul 2026 10:58:09 -0500
Subject: [PATCH 3/3] Revert publish-nuget for main only

---
 .github/workflows/build.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2bfb341..110f87a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -85,9 +85,7 @@ jobs:
       id-token: write  # enable GitHub OIDC token issuance for this job
 
     # Only run for main branch
-    #if: github.ref == 'refs/heads/main'
-    #Temporarily changed to all branches for testing
-    if: github.event_name != 'pull_request' && github.event_name != 'create'
+    if: github.ref == 'refs/heads/main'
 
     steps: