Skip to content

Trusted Publishing on nuget.org; publish 2.0 as 2.0.0-preview.1 - #155

Merged
Astn merged 6 commits into
masterfrom
nuget-trusted-publishing
Sep 25, 2026
Merged

Astn merged 6 commits into
masterfrom
nuget-trusted-publishing

Conversation

@Astn

@Astn Astn commented Sep 25, 2026 •

Copy link
Copy Markdown
Owner

Two things the owner asked for on 2026-09-25.

Trusted Publishing. The policy on nuget.org (owner AustinHarris, publisher GitHub Actions, repository Astn/JSON-RPC.NET, workflow build_publish_master.yml) replaces the stored API key.

  • The master workflow gets id-token: write and contents: read; NuGet/login@v1 exchanges the OIDC token for a one-hour API key right after the tests, with user: AustinHarris; the push uses that key and keeps --skip-duplicate.
  • The NugetKey secret is no longer referenced anywhere and can be deleted from the repository settings.
  • The pull-request workflow's non-fatal push of ci- suffixed packages is removed, along with the --version-suffix it needed: the policy is bound to the master workflow file, so that push could only fail from now on.

Preview. VersionSuffix is preview.1 on the four packages, so the master build packs 2.0.0-preview.1 (a --version-suffix on the command line still overrides it). The README's Installation says --prerelease and why, Versioning and support gains a Previews bullet, and the changelog heading names the preview.

Merging this triggers the master workflow, which publishes the four 2.0.0-preview.1 packages through the new policy. The earlier failed run cannot be re-run for this: a re-run uses the workflow file as it was.

Project URL. PackageProjectUrl on the four packages now points at the documentation site (https://astn.github.io/JSON-RPC.NET/, and the package's own page for the three companions); RepositoryUrl stays on GitHub.

Windows Phone 7. The AustinHarris.JsonRpc.Client.WP7 and AustinHarris.JsonRpc.Client.WP7Test projects are removed; the platform is no longer supported and nothing in 2.0 built from them.

Packaging. Every package now ships its XML documentation, a Source Link symbols package (.snupkg, built with ContinuousIntegrationBuild on master and pushed alongside the .nupkg), the site favicon as its icon, tags naming the target frameworks (nuget.org also lists them from the lib/ folders), and release notes that say what 2.0 is and link to the What is new and Upgrading from 1.x pages on the documentation site. Verified locally by packing all four and inspecting the .nuspec and contents.

Package README. The core shipped the repository README, which nuget.org renders without its HTML, relative links or images. Json-Rpc/README.md is written for that page (absolute links, the headline chart from raw.githubusercontent.com, a short Upgrading from 1.x summary) and points a 1.x user at What is new and Upgrading right after the install line; Visual Studio opens the package README on install and update, which is the only install-time hook NuGet still offers (install scripts were removed with PackageReference). The companion READMEs open the same way and the four descriptions are shorter. The chart URL resolves once #154 is on master.

Site. CHANGELOG.md is published as changelog.html (What is new) and the README's Upgrading from 1.x section moves to docs/upgrading.md, published as upgrading.html, so the package links land on their own pages; the README keeps a summary and links.

The master workflow now requests an OIDC token, exchanges it through
NuGet/login for a one-hour API key, and pushes with that. The NugetKey
secret is no longer read. The nuget.org policy is bound to this repository
and to the workflow file name, so the file keeps its name.
VersionSuffix preview.1 on the four packages (a --version-suffix on the
command line still overrides it). The README says to install with
--prerelease and what a preview promises; the changelog heading names the
preview. The pull-request workflow's non-fatal push of ci-suffixed packages
is gone: the trusted publishing policy is bound to the master workflow, so
that push could only fail.
@Astn Astn changed the title Publish to nuget.org with Trusted Publishing Trusted Publishing on nuget.org; publish 2.0 as 2.0.0-preview.1 Sep 25, 2026
The four packages' PackageProjectUrl is the published site (the package's
own page for the three companions); RepositoryUrl stays on GitHub.
Windows Phone 7 is no longer supported; the two projects were outside the solution and nothing in 2.0 built from them.
… upgrade guide gets its own page

Every package now ships its XML documentation (CS1591 silenced), a Source
Link symbols package built with ContinuousIntegrationBuild on master, the site
favicon as its icon, tags naming the target frameworks, and release notes that
say what 2.0 is and link to the What is new and Upgrading from 1.x pages on the
documentation site. The README's Upgrading from 1.x section moves to
docs/upgrading.md (the README keeps a summary and a link) so the site has an
upgrading.html to land on, and CHANGELOG.md is published as changelog.html.
One ambiguous cref in ServiceBinder fixed on the way.
The core package shipped the repository README, which nuget.org renders
without its HTML, relative links or images. Json-Rpc/README.md is written for
that page: what the library is, the prerelease install line, the quick start
from the repository README, the 1.2.3-versus-2.0 table with the headline chart
from raw.githubusercontent.com, the companion packages, a short Upgrading from
1.x summary, and absolute links to the documentation site. It points a 1.x user
at the What is new and Upgrading pages right after the install line, which is
what Visual Studio shows when it opens the README on install. The companion
READMEs open the same way, and the four package descriptions are shorter.
@Astn
Astn merged commit 805c64f into master Sep 25, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant