Publish to NuGet.org

Publish NuGet packages built from tags to NuGet.org.

Author: martincostello

.github/workflows/ci.yml

@@ -119,3 +119,45 @@ jobs:
           Write-Output "::error::$invalidPackages NuGet package(s) failed validation."
           exit 1
         }
+
+  publish-nuget:
+    needs: [ build-test, validate-packages ]
+    runs-on: ubuntu-latest
+    if: |
+      github.event.repository.fork == false &&
+      startsWith(github.ref, 'refs/tags/')
+
+    environment:
+      name: NuGet.org
+      url: https://www.nuget.org/profiles/Grafana
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+
+    - name: Download packages
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      with:
+        name: packages-windows
+
+    - name: Setup .NET SDK
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
+      with:
+        dotnet-version: ${{ needs.build-test.outputs.dotnet-sdk-version }}
+
+    # TODO Store the NuGet token in Vault
+    - uses: grafana/shared-workflows/actions/get-vault-secrets@9f37f656e063f0ad0b0bfc38d49894b57d363936 # get-vault-secrets/v1.2.1
+      id: get-token
+      with:
+        export_env: false
+        repo_secrets: |
+          token=nuget:token
+
+    - name: Push NuGet packages to NuGet.org
+      shell: bash
+      env:
+        API_KEY: ${{ fromJSON(steps.get-token.outputs.secrets).token }}
+        SOURCE: 'https://api.nuget.org/v3/index.json'
+      run: dotnet nuget push "*.nupkg" --api-key "${API_KEY}" --skip-duplicate --source "${SOURCE}"

.github/workflows/dependency-review.yml

@@ -24,4 +24,5 @@ jobs:
       - name: Review dependencies
         uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1
         with:
+          allow-dependencies-licenses: 'pkg:githubactions/grafana/shared-workflows/actions/get-vault-secrets'
           allow-licenses: 'Apache-2.0,BSD-3-Clause,MIT'