mirror of
https://github.com/dotnet/skills.git
synced 2026-09-20 09:49:54 +08:00
Larry Ewing
f7abee2099
* Add nuget-trusted-publishing skill Knowledge-driven skill for setting up NuGet trusted publishing (OIDC) on GitHub Actions repos, replacing long-lived API keys with short-lived tokens. Replaces #34 which could not be reopened after history rewrite. * Address review: move to plugins/tests layout, fix phase sequencing, add CODEOWNERS - Move skill from src/dotnet/skills/ to plugins/dotnet/skills/nuget-trusted-publishing/ - Move eval from src/dotnet/tests/ to tests/dotnet/nuget-trusted-publishing/ - Fix Phase 3/4 sequencing conflict: clarify that drafting the workflow is OK before policy confirmation, but publishing/removing secrets should wait - Add CODEOWNERS entry for nuget-trusted-publishing Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
55 lines
2.4 KiB
YAML
55 lines
2.4 KiB
YAML
scenarios:
|
|
- name: "Set up trusted publishing for a new NuGet library"
|
|
prompt: |
|
|
I have a .NET class library at src/MyLib/MyLib.csproj that I want to publish
|
|
to nuget.org using trusted publishing (OIDC) instead of an API key.
|
|
The repo is hosted on GitHub at myorg/mylib. Help me set this up.
|
|
assertions:
|
|
- type: "output_contains"
|
|
value: "NuGet/login"
|
|
- type: "output_contains"
|
|
value: "id-token"
|
|
- type: "output_matches"
|
|
pattern: "(trusted.?publishing|OIDC)"
|
|
rubric:
|
|
- "Guides the user to create a trusted publishing policy on nuget.org"
|
|
- "Mentions the workflow filename must match the nuget.org policy exactly"
|
|
- "Includes id-token: write in the workflow permissions"
|
|
- "Recommends local pack verification before publishing"
|
|
timeout: 120
|
|
- name: "Set up NuGet publishing without mentioning trusted publishing"
|
|
prompt: |
|
|
I have a .NET library at src/MyLib/MyLib.csproj and I want to publish it
|
|
to nuget.org securely from GitHub Actions without storing API keys.
|
|
The repo is at myorg/mylib. How do I set this up?
|
|
assertions:
|
|
- type: "output_contains"
|
|
value: "NuGet/login"
|
|
- type: "output_contains"
|
|
value: "id-token"
|
|
- type: "output_matches"
|
|
pattern: "(trusted.?publishing|OIDC)"
|
|
rubric:
|
|
- "Identifies that OIDC/trusted publishing is the right approach for keyless publishing"
|
|
- "Creates or shows a workflow with NuGet/login and id-token: write"
|
|
- "Guides the user to configure a trusted publishing policy on nuget.org"
|
|
- "Recommends local pack verification before publishing"
|
|
timeout: 120
|
|
- name: "Migrate existing workflow from API key to trusted publishing"
|
|
prompt: |
|
|
My current publish workflow uses secrets.NUGET_API_KEY to push packages.
|
|
I want to switch to NuGet trusted publishing (OIDC). What do I need to change?
|
|
assertions:
|
|
- type: "output_contains"
|
|
value: "NuGet/login"
|
|
- type: "output_contains"
|
|
value: "id-token"
|
|
- type: "output_matches"
|
|
pattern: "(api.?key|API.?KEY|NUGET_API_KEY)"
|
|
rubric:
|
|
- "Explains how to replace the API key with NuGet/login OIDC step"
|
|
- "Mentions adding id-token: write permission to the job"
|
|
- "Advises keeping the old API key secret until trusted publishing is verified"
|
|
- "Mentions creating a trusted publishing policy on nuget.org"
|
|
timeout: 120
|