Use NuGet Trusted Publishing

[martincostello]

Switch to using GitHub OIDC for pushing packages to NuGet.org with Trusted Publishing.

• Resolves Switch to NuGet trusted publishing #3566.
• Resolves https://github.com/domaindrivendev/Swashbuckle.AspNetCore/security/code-scanning/33.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.66%. Comparing base (3afee04) to head (de2a5b5).
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3574   +/-   ##
=======================================
  Coverage   94.66%   94.66%           
=======================================
  Files         111      111           
  Lines        3858     3858           
  Branches      778      778           
=======================================
  Hits         3652     3652           
  Misses        206      206           

Flag	Coverage Δ
Linux	94.66% <ø> (ø)
Windows	94.66% <ø> (ø)
macOS	94.66% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[martincostello]

API key has expired. Once Trusted Publishing has been configured can merge this and then release v10.0.2 again.

[martincostello]

Relevant changes have been made in NuGet, so this should work now. Will find out for sure when the next release happens.

[Copilot]

Pull request overview

This pull request attempts to implement NuGet Trusted Publishing using GitHub OIDC authentication to replace the traditional API key-based authentication for pushing packages to NuGet.org. However, the implementation appears to use a non-standard approach that may not work as intended.

Key Changes:

• Adds id-token: write permission to the publish-nuget job to enable OIDC token generation
• Introduces a NuGet log in step using an unverified NuGet/login action
• Changes API key source from secrets.NUGET_TOKEN to the output of the login step

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.