From 0287baa66945e1bf0c235820b1f17c1855be16f8 Mon Sep 17 00:00:00 2001
From: Devin Lyons <dlyons@mtasolutions.com>
Date: Wed, 12 Aug 2026 12:23:58 -0800
Subject: [PATCH] Update release pipelines.

---
 .github/workflows/giraffe-release.yml | 14 ++++++++++----
 .github/workflows/release.yml         | 16 +++++++++++-----
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/giraffe-release.yml b/.github/workflows/giraffe-release.yml
index 397fe09..cde88c7 100644
--- a/.github/workflows/giraffe-release.yml
+++ b/.github/workflows/giraffe-release.yml
@@ -4,6 +4,8 @@ on:
     - "giraffe-v[0-9]+.[0-9]+.[0-9]+"
 jobs:
   build:
+    permissions:
+      id-token: write  # enable GitHub OIDC token issuance for this job
 
     runs-on: ubuntu-latest
     
@@ -36,8 +38,12 @@ jobs:
       - name: Pack
         run: dotnet pack --configuration Release /p:NuGetVersion=${VERSION} /p:PackageVersion=${VERSION} --output .
 
-      - name: Push
-        run: dotnet nuget push FSharp.Data.Validation.Giraffe.${VERSION}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${MTA_NUGET_KEY} --symbol-source https://symbols.nuget.org/download/symbols --symbol-api-key ${MTA_NUGET_KEY} 
+      # Get a short-lived NuGet API key
+      - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: ${{secrets.NUGET_USERNAME}}
 
-        env:
-          MTA_NUGET_KEY: ${{ secrets.MTA_NUGET_KEY }}
\ No newline at end of file
+      - name: Push
+        run: dotnet nuget push FSharp.Data.Validation.Giraffe.${VERSION}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{steps.login.outputs.NUGET_API_KEY}} --include-symbols
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dd92672..d12e86c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,8 @@ on:
     - "v[0-9]+.[0-9]+.[0-9]+"
 jobs:
   build:
+    permissions:
+      id-token: write  # enable GitHub OIDC token issuance for this job
 
     runs-on: ubuntu-latest
 
@@ -36,10 +38,14 @@ jobs:
       - name: Pack
         run: dotnet pack --configuration Release /p:NuGetVersion=${VERSION} /p:PackageVersion=${VERSION} --include-symbols --output .
 
+      # Get a short-lived NuGet API key
+      - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: ${{secrets.NUGET_USERNAME}}
+
       - name: Push
         run: |
-          dotnet nuget push FSharp.Data.Validation.${VERSION}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${MTA_NUGET_KEY} --symbol-source https://symbols.nuget.org/download/symbols --symbol-api-key ${MTA_NUGET_KEY}
-          dotnet nuget push FSharp.Data.Validation.Async.${VERSION}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${MTA_NUGET_KEY} --symbol-source https://symbols.nuget.org/download/symbols --symbol-api-key ${MTA_NUGET_KEY}
-
-        env:
-          MTA_NUGET_KEY: ${{ secrets.MTA_NUGET_KEY }}
\ No newline at end of file
+          dotnet nuget push FSharp.Data.Validation.${VERSION}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{steps.login.outputs.NUGET_API_KEY}} --include-symbols
+          dotnet nuget push FSharp.Data.Validation.Async.${VERSION}.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{steps.login.outputs.NUGET_API_KEY}} --include-symbols