From b751957f3b38dd0aaaccdef37e77bf5227ad47e9 Mon Sep 17 00:00:00 2001 From: "opencode-agent[bot]" Date: Thu, 22 Oct 2026 18:38:37 -0700 Subject: [PATCH] Drop the trackdubllc NUGET_USER fallback in the release workflow The NUGET_USER secret supplies the nuget.org username; the hardcoded fallback named the repository's previous owner and could only ever produce a 401 from the token exchange. Fail early with a message naming the setting instead. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 381a889..4d8b666 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -228,12 +228,23 @@ jobs: name: nuget-packages path: artifacts/packages + # The nuget.org username of the Trusted Publishing policy's creator (not the owner). + # No fallback: without it the token exchange fails with an unhelpful 401. + - name: Check NuGet user + env: + NUGET_USER: ${{ vars.NUGET_USER || secrets.NUGET_USER }} + run: | + if [ -z "$NUGET_USER" ]; then + echo "::error::Set the NUGET_USER repository variable or secret to the nuget.org username that created the Trusted Publishing policy." + exit 1 + fi + # Exchange GitHub Actions OIDC token for temporary NuGet API key - name: NuGet login (OIDC → temp API key) uses: NuGet/login@v1 id: nuget-login with: - user: ${{ vars.NUGET_USER || secrets.NUGET_USER || 'trackdubllc' }} + user: ${{ vars.NUGET_USER || secrets.NUGET_USER }} - name: Push to NuGet.org run: |