Move package publishing from MyGet to NuGet trusted publishing

.github/workflows/CI.yml

@@ -61,6 +61,15 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0  # Fetch the full history
+      # Surfaced early, and before restore/build, so the version to release is visible even if
+      # something later in this (long) job fails. Cutting a release means creating a GitHub Release
+      # tagged with whatever this prints; release.yml then verifies the tag agrees with nbgv.
+      - name: Report computed version
+        run: |
+          dotnet tool install --global nbgv
+          $version = nbgv get-version --project src/StackExchange.Redis --variable NuGetPackageVersion
+          "### Computed package version: ``$version``" >> $env:GITHUB_STEP_SUMMARY
+          Write-Output "Computed package version: $version"
       # Restore is ~80s of the build step on a cold runner, and the package set changes rarely.
       #
       # Keep this immediately after checkout, and *before* the WSL/redis steps. The key globs the whole
@@ -234,10 +243,3 @@ jobs:
           name: test-results-windows
           path: test-results/*.trx
           retention-days: 14
-      # Package and upload to MyGet only on pushes to main/v3, not on PRs
-      - name: .NET Pack
-        if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/v3')
-        run: dotnet pack Build.csproj --no-build -c Release /p:PackageOutputPath=${env:GITHUB_WORKSPACE}\.nupkgs /p:CI=true
-      - name: Upload to MyGet
-        if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/v3')
-        run: dotnet nuget push ${env:GITHUB_WORKSPACE}\.nupkgs\*.nupkg -s https://www.myget.org/F/stackoverflow/api/v2/package -k ${{ secrets.MYGET_API_KEY }}

.github/workflows/release.yml

@@ -0,0 +1,79 @@
+# Publishes to nuget.org when a GitHub Release is published.
+#
+# Auth is NuGet Trusted Publishing (OIDC): no long-lived API key is stored anywhere.
+# The one-time setup on nuget.org is: username menu -> Trusted Publishing -> add policy with
+#   Repository Owner: StackExchange / Repository: StackExchange.Redis / Workflow File: release.yml
+#   Environment: release
+# plus a NUGET_USER repository secret holding the nuget.org profile name to publish as.
+#
+# Versioning note: Nerdbank.GitVersioning computes the version from version.json plus commit
+# height - the tag name does not set it. Read the version to tag off the CI run's step summary
+# ("Report computed version" in CI.yml) and create the release with that tag; the guard step
+# below fails the run on any mismatch rather than publishing a package that disagrees with its
+# release.
+#
+# Deliberately does not run tests: the commit being released already passed CI, and this job's
+# only job is to reproduce that build byte-for-byte and push it. Also deliberately runs on Linux,
+# not Windows: net461/net472 build fine against their reference assemblies without a Windows
+# runtime, and nothing here executes test code.
+
+name: Release
+
+on:
+  release:
+    types: [published]
+  # dry run: everything except the tag check and the push, so the pipeline can be
+  # proven (and the packages inspected, via the run artifact) without cutting a release
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write # for the OIDC exchange with nuget.org
+      contents: read
+
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        fetch-depth: 0  # Fetch the full history (for versioning)
+    - name: Install .NET SDK
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: |
+          8.0.x
+          10.0.x
+    - name: Verify tag matches computed version
+      if: github.event_name == 'release'
+      run: |
+        dotnet tool install --global nbgv
+        computed=$(nbgv get-version --project src/StackExchange.Redis --variable NuGetPackageVersion)
+        tag="${{ github.event.release.tag_name }}"
+        tag="${tag#v}"
+        if [ "$computed" != "$tag" ]; then
+          echo "::error::Tag '$tag' does not match the computed version '$computed'; retag the release commit so the two agree."
+          exit 1
+        fi
+        echo "Publishing $computed"
+    - name: Restore dependencies
+      run: dotnet restore Build.csproj
+    - name: Build
+      run: dotnet build Build.csproj --no-restore -c Release /p:CI=true
+    - name: Pack
+      run: dotnet pack Build.csproj --no-build -c Release /p:CI=true /p:PackageOutputPath=${{ github.workspace }}/.nupkgs
+    # The packages survive as a run artifact even if the push fails
+    - name: Upload packages
+      uses: actions/upload-artifact@v4
+      with:
+        name: packages
+        path: .nupkgs/*.nupkg
+    - name: NuGet login (OIDC to temp API key)
+      if: github.event_name == 'release'
+      uses: NuGet/login@v1
+      id: login
+      with:
+        user: ${{ secrets.NUGET_USER }}
+    - name: Push to nuget.org
+      if: github.event_name == 'release'
+      run: dotnet nuget push .nupkgs/*.nupkg --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate

README.md

@@ -11,10 +11,8 @@ For all documentation, [see here](https://seredis.dev/).
 
 #### Package Status
 
-MyGet Pre-release feed: https://www.myget.org/gallery/stackoverflow
-
-| Package | NuGet Stable | NuGet Pre-release | Downloads | MyGet |
-| ------- | ------------ | ----------------- | --------- | ----- |
-| [StackExchange.Redis](https://www.nuget.org/packages/StackExchange.Redis/) | [![StackExchange.Redis](https://img.shields.io/nuget/v/StackExchange.Redis.svg)](https://www.nuget.org/packages/StackExchange.Redis/) | [![StackExchange.Redis](https://img.shields.io/nuget/vpre/StackExchange.Redis.svg)](https://www.nuget.org/packages/StackExchange.Redis/absoluteLatest) | [![StackExchange.Redis](https://img.shields.io/nuget/dt/StackExchange.Redis.svg)](https://www.nuget.org/packages/StackExchange.Redis/) | [![StackExchange.Redis MyGet](https://img.shields.io/myget/stackoverflow/vpre/StackExchange.Redis.svg)](https://www.myget.org/feed/stackoverflow/package/nuget/StackExchange.Redis) |
+| Package | NuGet Stable | NuGet Pre-release | Downloads |
+| ------- | ------------ | ----------------- | --------- |
+| [StackExchange.Redis](https://www.nuget.org/packages/StackExchange.Redis/) | [![StackExchange.Redis](https://img.shields.io/nuget/v/StackExchange.Redis.svg)](https://www.nuget.org/packages/StackExchange.Redis/) | [![StackExchange.Redis](https://img.shields.io/nuget/vpre/StackExchange.Redis.svg)](https://www.nuget.org/packages/StackExchange.Redis/absoluteLatest) | [![StackExchange.Redis](https://img.shields.io/nuget/dt/StackExchange.Redis.svg)](https://www.nuget.org/packages/StackExchange.Redis/) |
 
 Release notes at: [GitHub Releases](https://github.com/StackExchange/StackExchange.Redis/releases) (3.0 onwards; [earlier releases](https://seredis.dev/ReleaseNotes))

docs/ReleaseNotes.md

@@ -2,9 +2,9 @@
 
 Current package versions:
 
-| NuGet Stable | NuGet Pre-release | MyGet |
-| ------------ | ----------------- | ----- |
-| [![StackExchange.Redis](https://img.shields.io/nuget/v/StackExchange.Redis.svg)](https://www.nuget.org/packages/StackExchange.Redis/) | [![StackExchange.Redis](https://img.shields.io/nuget/vpre/StackExchange.Redis.svg)](https://www.nuget.org/packages/StackExchange.Redis/) | [![StackExchange.Redis MyGet](https://img.shields.io/myget/stackoverflow/vpre/StackExchange.Redis.svg)](https://www.myget.org/feed/stackoverflow/package/nuget/StackExchange.Redis) |
+| NuGet Stable | NuGet Pre-release |
+| ------------ | ----------------- |
+| [![StackExchange.Redis](https://img.shields.io/nuget/v/StackExchange.Redis.svg)](https://www.nuget.org/packages/StackExchange.Redis/) | [![StackExchange.Redis](https://img.shields.io/nuget/vpre/StackExchange.Redis.svg)](https://www.nuget.org/packages/StackExchange.Redis/) |
 
 ## 3.0