chore(CD): switch from secret API key to Trusted Publishing on nuget.org

.github/workflows/formatting.yml

@@ -7,10 +7,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - name: Setup .NET 8
+      - name: Setup .NET
         uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 8.0.100
+          dotnet-version: 10
       - name: Restore .NET tools
         run: dotnet tool restore
         working-directory: ./JsonPatchDocumentExtensionDataAdapter

.github/workflows/nuget_package_push.yml → .github/workflows/release_nuget.yml

@@ -7,15 +7,19 @@ on:
 
 jobs:
   pushrelease:
-    runs-on: windows-latest
+    runs-on: ubuntu-latest
     env:
       ACTIONS_ALLOW_UNSECURE_COMMANDS: "true"
+    permissions:
+      id-token: write # enable GitHub OIDC token issuance for this job
+    environment: "release" # has to match the policy name in the nuget.org Trusted Publishing setup.
+    # if the environment name is not set here, you'll run into an error message like "Error: Token exchange failed (401): Environment mismatch for policy 'release': expected 'release', actual ''"
     steps:
       - uses: actions/checkout@v6
       - name: Setup .NET Core
         uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 8.0.100
+          dotnet-version: 10
       - uses: olegtarasov/get-tag@v2.1
         id: tagChrono
         with:
@@ -29,12 +33,13 @@ jobs:
       - name: Create Package JsonPatchDocumentExtensionDataAdapter (dotnet pack)
         working-directory: "JsonPatchDocumentExtensionDataAdapter/JsonPatchDocumentExtensionDataAdapter"
         run: dotnet pack JsonPatchDocumentExtensionDataAdapter.csproj --configuration Release -p:PackageVersion="${{ steps.tagChrono.outputs.tag }}"
-      - name: Setup Nuget.exe
-        uses: warrenbuckley/Setup-Nuget@v1
+      - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: hf-kklein
+        # because the package is owned by hf-kklein: https://www.nuget.org/packages/JsonPatchDocumentExtensionDataAdapter
       - name: Nuget push JsonPatchDocumentExtensionDataAdapter
         working-directory: "JsonPatchDocumentExtensionDataAdapter/JsonPatchDocumentExtensionDataAdapter"
-        # token: https://github.com/Hochfrequenz/JsonPatchDocumentExtensionDataAdapter/settings/secrets/actions/NUGET_ORG_PUSH_TOKEN
-        # expires 2026-09-21
         run: |
-          nuget setApiKey ${{ secrets.NUGET_ORG_PUSH_TOKEN }}
-          nuget push .\bin\Release\*.nupkg -Source https://api.nuget.org/v3/index.json -SkipDuplicate -NoSymbols
+          dotnet nuget push ./bin/Release/*.nupkg --source https://api.nuget.org/v3/index.json  --api-key ${{steps.login.outputs.NUGET_API_KEY}} --skip-duplicate

.github/workflows/unittests_and_coverage.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        dotnet-version: [ "8.0.401" ]
+        dotnet-version: ["8", "9", "10"]
     steps:
       - uses: actions/checkout@v6
       - name: Setup .NET Core
@@ -25,7 +25,7 @@ jobs:
       - name: Setup .NET Core
         uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 8.0.100
+          dotnet-version: 10
       - name: Install dependencies
         working-directory: ./JsonPatchDocumentExtensionDataAdapter
         run: dotnet restore