Repository navigation
Move NUGET_API_KEY from repo secret to nuget-org environment secret #273
Description
Sibling of milestone #13. RFC #267.
What
Migrate NUGET_API_KEY from a repo-level Actions secret to an environment-scoped secret on the nuget-org GitHub Environment. This is the half of the env split that actually matters: the secret only becomes available to jobs that target environment: nuget-org, which combined with the approval gate means no accidental publishes from non-release workflows.
Acceptance criteria
-
NUGET_API_KEYexists as an environment secret onnuget-org. -
NUGET_API_KEYrepo secret deleted (or kept as a transitional backup with a documented sunset). -
release.yml's reference to${{ secrets.NUGET_API_KEY }}continues to work in the job that declaresenvironment: nuget-org. - No other workflow references this secret (verified via repo-wide grep on workflow files).
Depends on
- Three environments exist (sibling issue).
Blocks
- Refactor
release.yml(the workflow needs to declareenvironment: nuget-orgon the publish step).
Risk
- A botched migration leaves the workflow without the secret. Mitigate by doing the env-secret add first, then deleting the repo secret only after the next successful workflow run.
Activity
docs(agents): release-branch model + branch-protection policy for rel…
ChrisonSimtian commentedon May 29, 2026
Draft PR #280 prepped — adds
environment: nuget-orgto the release job sosecrets.NUGET_API_KEYresolves from the env-scoped secret. Held as draft until the env secret value is in place (GitHub secrets are write-only, so this step is a manual UI action by Chris).Your turn (Chris) — adding the secret value
NUGET_API_KEY. Value: existing key from password manager, OR generate a fresh key on nuget.org and use that (rotation hygiene — recommended).release→ Run workflow → approve at the gate → publish succeeds.NUGET_API_KEYat https://github.com/ChrisonSimtian/Fallout/settings/secrets/actions.If you want to test the gate without doing a real publish first, run the
releaseworkflow but cancel after the approval-gate prompt fires — that proves the env wiring works without burning a release.ci: declare release job as deploying to nuget-org environment (#273) (#…
ChrisonSimtian commentedon May 29, 2026
Done. PR #280 merged (06:06:33Z). All three halves of #273 landed:
NUGET_API_KEYset as env-scoped secret onnuget-org(done manually by Chris via UI)NUGET_API_KEYsecret deleted (also manually)release.ymldeclaresenvironment: nuget-orgon the release job —${{ secrets.NUGET_API_KEY }}now resolves from the env scope, and the env's required-reviewer rule (Chris) fires before the job runsVerification path (optional)
If you want belt-and-braces validation: Actions →
release→ "Run workflow" onmain→ expect an approval-gate prompt before any step runs. Cancel at the gate without approving — proves the env wiring works without burning a release.What's unblocked next
#274 — the big
release.ymlrefactor (tag-triggered + multi-channel fan-out + tag protection ruleset). The largest single piece of milestone #13 still ahead.docs: release-branch model — CONTRIBUTING + branching-and-release run…
ci(release): publish the 10.3.x channel from release/v10.3 on merge
chore(release): stage clean 10.3.48 marker on release/v10.3 (#296)