I use a publish-nuget.yml reusable workflow from a different repository than the one I want to publish from, but this setup does not allow me to use Trusted Publishing.
This is how such error typically looks like:
Error: Token exchange failed (HTTP 401) at https://www.nuget.org/api/v2/token. Make sure you are using the username of the policy creator, not the policy owner: Claim 'job_workflow_ref' has value '<username>/workflows/.github/workflows/publish-nuget.yml@refs/heads/main' which does not start with <username>/<other_repo>/.github/workflows/.
I expect to create a policy for my <other_repo>, as that has the workflow I'm actually publishing from. I also tried creating a policy for the workflows repo, but that already feels like it opens me to some security vulnerabilities if (in theory) anyone using my reusable workflow could upload to my NuGet feed. But this yields the same error anyway due to the does not start with check ensuring only workflows repo can do so.
I also tried having a separate job that just generated the short-lived token and tried to pass it to the reusable workflow, as steps and reusable workflows cannot be combined, but secrets also do get lost between jobs even when outputted: Warning: Skip output 'api-key' since it may contain secret.
So I'm stuck here and cannot transition to Trusted Publishing without duplicating my workflow to every repo, while being "forced" by the NuGet.org web to do so. Checking the code of this action, it doesn't seem like it can be fixed in place here, it probably needs some backend changes, something to make job_workflow_ref become the <other_repo>'s workflow (respectively starting path), which uses that reusable workflow, and then perhaps allowing that configuration in this action in case it opens up some holes.
I use a
publish-nuget.ymlreusable workflow from a different repository than the one I want to publish from, but this setup does not allow me to use Trusted Publishing.This is how such error typically looks like:
I expect to create a policy for my
<other_repo>, as that has the workflow I'm actually publishing from. I also tried creating a policy for theworkflowsrepo, but that already feels like it opens me to some security vulnerabilities if (in theory) anyone using my reusable workflow could upload to my NuGet feed. But this yields the same error anyway due to thedoes not start withcheck ensuring onlyworkflowsrepo can do so.I also tried having a separate job that just generated the short-lived token and tried to pass it to the reusable workflow, as steps and reusable workflows cannot be combined, but secrets also do get lost between jobs even when outputted:
Warning: Skip output 'api-key' since it may contain secret.So I'm stuck here and cannot transition to Trusted Publishing without duplicating my workflow to every repo, while being "forced" by the NuGet.org web to do so. Checking the code of this action, it doesn't seem like it can be fixed in place here, it probably needs some backend changes, something to make
job_workflow_refbecome the<other_repo>'s workflow (respectively starting path), which uses that reusable workflow, and then perhaps allowing that configuration in this action in case it opens up some holes.