Trusted Publishing on nuget.org; publish 2.0 as 2.0.0-preview.1

.github/workflows/build_publish_master.yml

@@ -5,6 +5,14 @@ on:
       - "**/*.md"
     branches: [ master ]
 
+# Publishing uses nuget.org Trusted Publishing: the job requests an OIDC token from GitHub, NuGet/login exchanges
+# it for an API key that lives one hour, and the push uses that key. No long-lived NuGet secret is stored here.
+# The nuget.org policy is bound to this repository and to this file's name (build_publish_master.yml); renaming
+# the file or moving the push to another workflow needs a new policy on nuget.org.
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   build:
 
@@ -24,13 +32,22 @@ jobs:
         run: dotnet restore AustinHarris.JsonRpc.sln
       # Building the solution packs every package project (GeneratePackageOnBuild); `dotnet pack` on the
       # solution would trip NU5026 with GeneratePackageOnBuild, so the packages come from the build.
+      # ContinuousIntegrationBuild makes the build deterministic and lets Source Link map the symbols package
+      # (.snupkg, pushed alongside each .nupkg) back to this commit on GitHub.
       - name: Build
-        run: dotnet build AustinHarris.JsonRpc.sln --configuration Release --no-restore
+        run: dotnet build AustinHarris.JsonRpc.sln --configuration Release --no-restore -p:ContinuousIntegrationBuild=true
       - name: Test
         run: dotnet test AustinHarris.JsonRpcTestN --configuration Release --no-build
+      # The key is requested after the tests so it is fresh for the push (it expires after one hour). `user` is the
+      # nuget.org profile that owns the packages and the trusted publishing policy.
+      - name: NuGet login (OIDC to a temporary API key)
+        uses: NuGet/login@v1
+        id: nuget-login
+        with:
+          user: AustinHarris
       # Publish all four packages: the core and the three companions (Json.NET, System.Text.Json, ASP.NET Core).
       - name: publish nuget version change
         run: |
           for project in Json-Rpc AustinHarris.JsonRpc.Newtonsoft AustinHarris.JsonRpc.SystemTextJson AustinHarris.JsonRpc.AspNetCore; do
-            dotnet nuget push "$project/bin/Release/"*.nupkg --skip-duplicate --source "https://api.nuget.org/v3/index.json" --api-key ${{ secrets.NugetKey }} # API key for the NuGet feed
+            dotnet nuget push "$project/bin/Release/"*.nupkg --skip-duplicate --source "https://api.nuget.org/v3/index.json" --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}"
           done

.github/workflows/build_pull_request.yml

@@ -29,16 +29,8 @@ jobs:
       # Building the solution packs every package project (GeneratePackageOnBuild); `dotnet pack` on the
       # solution would trip NU5026 with GeneratePackageOnBuild, so the packages come from the build.
       - name: Build
-        run: dotnet build AustinHarris.JsonRpc.sln --configuration Release --no-restore --version-suffix ci-${{ github.run_id }}-${{ github.run_number }}
+        run: dotnet build AustinHarris.JsonRpc.sln --configuration Release --no-restore
       - name: Test
         run: dotnet test AustinHarris.JsonRpcTestN --configuration Release --no-build
-      # Publish all four pre-release packages: the core and the three companions (Json.NET, System.Text.Json, ASP.NET Core).
-      # Non-fatal: the build and tests are the pull-request verdict; a rejected key (403) or a fork's missing secret
-      # shows as a warning here and fails loudly in the master workflow instead.
-      - name: publish nuget version change
-        if: ${{ matrix.os == 'ubuntu-latest' }}
-        continue-on-error: true
-        run: |
-          for project in Json-Rpc AustinHarris.JsonRpc.Newtonsoft AustinHarris.JsonRpc.SystemTextJson AustinHarris.JsonRpc.AspNetCore; do
-            dotnet nuget push "$project/bin/Release/"*.nupkg --skip-duplicate --source "https://api.nuget.org/v3/index.json" --api-key ${{ secrets.NugetKey }} # API key for the NuGet feed
-          done
+      # Pull requests do not publish. Packages go out from the master workflow through Trusted Publishing, whose
+      # nuget.org policy is bound to build_publish_master.yml; nothing else can push.

AustinHarris.JsonRpc.AspNetCore/AustinHarris.JsonRpc.AspNetCore.csproj

@@ -4,26 +4,34 @@
         <Company>Austin Harris</Company>
         <Authors>Austin Harris</Authors>
         <Product>Json-Rpc.Net ASP.NET Core host</Product>
-        <Description>ASP.NET Core / Kestrel hosting for JSON-RPC.Net: MapJsonRpc endpoint (PipeReader in, BodyWriter out, no strings), a raw Kestrel ConnectionHandler for JSON-RPC over TCP, and DI registration of services.</Description>
+        <Description>ASP.NET Core hosting for AustinHarris.JsonRpc. Adds HTTP endpoints and raw Kestrel connections over TCP, Unix sockets and named pipes, with dependency injection.</Description>
         <VersionPrefix>2.0.0</VersionPrefix>
-        <PackageReleaseNotes>https://github.com/Astn/JSON-RPC.NET/blob/master/CHANGELOG.md</PackageReleaseNotes>
-        <VersionSuffix>$(VersionSuffix)</VersionSuffix>
+        <VersionSuffix>preview.1</VersionSuffix>
+        <PackageReleaseNotes>2.0.0-preview.1, released with the core package. What is new: https://astn.github.io/JSON-RPC.NET/changelog.html. Upgrading from 1.x: https://astn.github.io/JSON-RPC.NET/upgrading.html</PackageReleaseNotes>
         <Copyright>Austin Harris</Copyright>
-        <PackageProjectUrl>https://github.com/Astn/JSON-RPC.NET</PackageProjectUrl>
+        <PackageProjectUrl>https://astn.github.io/JSON-RPC.NET/aspnetcore.html</PackageProjectUrl>
         <RepositoryUrl>https://github.com/Astn/JSON-RPC.NET</RepositoryUrl>
         <RepositoryType>git</RepositoryType>
         <PackageLicenseExpression>MIT</PackageLicenseExpression>
         <PackageReadmeFile>README.md</PackageReadmeFile>
-        <PackageTags>json-rpc;jsonrpc;json;rpc;server;aspnetcore;kestrel;pipelines</PackageTags>
+        <PackageTags>json-rpc;jsonrpc;json;rpc;server;aspnetcore;asp.net-core;kestrel;pipelines;tcp;net8.0;net10.0</PackageTags>
         <TargetFrameworks>net8.0;net10.0</TargetFrameworks>
         <LangVersion>latest</LangVersion>
         <Nullable>disable</Nullable>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <IncludeSymbols>true</IncludeSymbols>
+        <SymbolPackageFormat>snupkg</SymbolPackageFormat>
+        <PublishRepositoryUrl>true</PublishRepositoryUrl>
+        <EmbedUntrackedSources>true</EmbedUntrackedSources>
+        <PackageIcon>icon.png</PackageIcon>
         <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
         <RootNamespace>AustinHarris.JsonRpc.AspNetCore</RootNamespace>
     </PropertyGroup>
 
     <ItemGroup>
         <None Include="README.md" Pack="true" PackagePath="\" />
+        <None Include="..\icon.png" Pack="true" PackagePath="\" />
     </ItemGroup>
 
     <ItemGroup>

AustinHarris.JsonRpc.AspNetCore/README.md

@@ -1,14 +1,17 @@
-# AustinHarris.JsonRpc.AspNetCore
+# `AustinHarris.JsonRpc.AspNetCore`
 
-Hosts [JSON-RPC.Net](https://github.com/Astn/JSON-RPC.NET) in ASP.NET Core. The core processes requests as
-UTF-8 bytes, so the HTTP endpoint reads the body with `PipeReader` and writes straight into
-`Response.BodyWriter`; nothing is turned into a string on the way through. A `ConnectionHandler` does the
-same for JSON-RPC over a raw Kestrel connection (TCP, Unix socket, named pipe).
+`AustinHarris.JsonRpc.AspNetCore` hosts
+[`AustinHarris.JsonRpc`](https://www.nuget.org/packages/AustinHarris.JsonRpc) 2.0 in ASP.NET Core
+and registers services through dependency injection.
+Choose it for an HTTP endpoint or raw Kestrel connections over TCP, Unix sockets or named pipes.
+
+The HTTP endpoint reads with `PipeReader` and writes to `Response.BodyWriter`
+without converting the document to a string.
 
 ## Install
 
-```
-dotnet add package AustinHarris.JsonRpc.AspNetCore
+```sh
+dotnet add package AustinHarris.JsonRpc.AspNetCore --prerelease
 ```
 
 Targets `net8.0` and `net10.0`; depends on the `AustinHarris.JsonRpc` core package and the ASP.NET Core shared