Use Nuget's Trusted Publishing.

Author: hajekj

.github/workflows/release.yml

@@ -11,12 +11,16 @@ jobs:
   release:
     runs-on: ubuntu-latest
 
-    # TODO: Switch to trusted publishing in future
     permissions:
       id-token: write
 
     steps:
     - uses: actions/checkout@v4
+    - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: ${{ secrets.NUGET_USER }}
     - name: Extract version from tag
       id: get_version
       run: |
@@ -40,4 +44,4 @@ jobs:
     - name: Publish the package to nuget.org
       run: dotnet nuget push */bin/Release/*.nupkg -k $NUGET_AUTH_TOKEN -s https://api.nuget.org/v3/index.json
       env:
-        NUGET_AUTH_TOKEN: ${{ secrets.NUGET_TOKEN }}
+        NUGET_AUTH_TOKEN: ${{ steps.login.outputs.NUGET_API_KEY }}