From 3f9e8b2a4a6f6aaadff212e1ba7b2eca285446fb Mon Sep 17 00:00:00 2001
From: hamza-browserstack <hamza.a@browserstack.com>
Date: Thu, 5 Nov 2026 19:53:57 +0530
Subject: [PATCH] Updated release workfow for trusted policy

---
 .github/workflows/cd.yml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index b8661c2..ca0b1db 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -3,10 +3,11 @@ name: .NET package CD
 on: [workflow_dispatch]
 
 # Least privilege: no step in this workflow writes to the repo,
-# releases or packages via GITHUB_TOKEN (publishing uses NUGET_API_KEY,
+# releases or packages via GITHUB_TOKEN (publishing uses NUGET_API_KEY, (deprecated, now uses trusted publishing setup)
 # signing uses GCP_SA_KEY). Fail closed regardless of the org default.
 permissions:
   contents: read
+  id-token: write
 
 defaults:
   run:
@@ -17,6 +18,11 @@ jobs:
     runs-on: windows-latest
 
     steps:
+    - name: NuGet login (OIDC → temp API key)
+      uses: NuGet/login@v1
+      id: login
+      with:
+        user: browserstack
     - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
     - name: Add msbuild to PATH
       uses: microsoft/setup-msbuild@c26a08ba26249b81327e26f6ef381897b6a8754d # v1.0.2
@@ -70,9 +76,9 @@ jobs:
         path: .\BrowserStackLocal\BrowserStackLocal\bin\Release\*.nupkg
     - name: Push package to Nuget Repository
       working-directory: ${{ github.workspace }}
-      run: dotnet nuget push BrowserStackLocal/BrowserStackLocal/bin/Release/*.nupkg --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json
-      env:
-        NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+      run: dotnet nuget push BrowserStackLocal/BrowserStackLocal/bin/Release/*.nupkg --api-key "${{steps.login.outputs.NUGET_API_KEY}}" --source https://api.nuget.org/v3/index.json
+      # env:
+      #   NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
       shell: bash
     - name: Cleanup credentials
       if: always()