Merge pull request #3204 from nojaf/trusted-publishing

Setup trusted publishing

Author: nojaf

.github/workflows/main.yml

@@ -33,12 +33,6 @@ jobs:
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: ./output
-    - name: "Publish"
-      if: matrix.os == 'windows-latest' && github.ref == 'refs/heads/main'
-      env:
-        NUGET_KEY: ${{ secrets.NUGET_KEY }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: dotnet fsi build.fsx -p Release
 
   analyze:
     name: Analyze solution

.github/workflows/release.yml

@@ -0,0 +1,36 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
+  DOTNET_CLI_TELEMETRY_OPTOUT: true
+
+jobs:
+  release:
+    runs-on: windows-latest
+    environment: release
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
+    steps:
+    - uses: actions/checkout@v6
+    - name: Setup .NET Core
+      uses: actions/setup-dotnet@v5
+    - name: Init
+      run: dotnet fsi build.fsx -p Init
+    - name: Obtain NuGet key
+      # this hash is v1.1.0
+      uses: NuGet/login@d22cc5f58ff5b88bf9bd452535b4335137e24544
+      id: login
+      with:
+        user: ${{ secrets.NUGET_USER }}
+    - name: "Publish"
+      env:
+        NUGET_KEY:  ${{ steps.login.outputs.NUGET_API_KEY }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: dotnet fsi build.fsx -p Release

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [7.0.4] - 2025-12-05
+
+### Changed
+
+- Add trusted publishing. [#3204](https://github.com/fsprojects/fantomas/pull/3204)
+
 ## [7.0.3] - 2025-07-04
 
 ### Fixed

build.fsx

@@ -431,6 +431,9 @@ let getCurrentAndLastReleaseFromChangelog () =
 
 pipeline "Release" {
     workingDir __SOURCE_DIRECTORY__
+    stage "Build" { run "dotnet build -c Release" }
+    stage "UnitTests" { run "dotnet test -c Release" }
+    stage "Pack" { run "dotnet pack -c Release" }
     stage "Release" {
         run (fun _ ->
             async {