Publish to nuget.org with trusted publishing

[trejjam]

Publishes to nuget.org with trusted publishing instead of the NUGET_API_KEY secret, whose key expires on 1 November 2026.

release.yml:

• The publish job gets id-token: write, so GitHub issues an OIDC token.
• NuGet/login@v1 exchanges it for a temporary API key right before the nuget.org push; the key is valid for one hour.
• The nuget.org push uses that key.
• Pushes use --skip-duplicate, so a release that failed half way can be re-run.
• The nuget.org user comes from the repository variable NUGET_USER (trejbal), already set.

Before the next release

nuget.org → Trusted Publishing → add a policy:

• Package owner: aviationexam
• Packages: GitReader.SourceGenerator
• Repository: aviationexam/git-reader-source-generator
• Workflow file: release.yml, no environment

After the first successful release

Delete the NUGET_API_KEY repository secret and revoke the nuget.org key.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T22:25:24.558448Z	bd0a36f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.