[sentry-junior]

Switches the nuget target to nuget.org trusted publishing. When getsentry/publish runs a release, Craft exchanges its GitHub OIDC token for a temporary nuget.org API key, so we no longer depend on a long-lived NUGET_API_TOKEN that someone has to renew by hand. The 6.13.0 release failed because that token expired (getsentry/publish#10356).

Refs getsentry/publish#6754

#skip-changelog

Changes

• minVersion: 3.12.0: this is the first Craft release with trusted publishing (feat(nuget): Support nuget.org trusted publishing with GitHub OIDC craft#972). It is being published in publish: getsentry/craft@3.12.0 publish#10373.
• trustedPublishingUser on the nuget target. Craft's workspace expansion copies it to every package target.

⚠️ Do not merge yet

1. The value is a placeholder. TODO-nuget-policy-creator must be replaced with the nuget.org profile name of the person who created the trusted publishing policy. The sentry org name won't work, and nuget.org rejects the token exchange if the name is wrong.
2. The nuget.org policy has to exist first. A member of the sentry owner on nuget.org has to add it under Trusted Publishing, ideally from a shared or bot account. Settings:
   • Repository owner: getsentry
   • Repository: publish
   • Workflow file: publish.yml
   • Environment: production
   • Policy owner: sentry
3. Craft 3.12.0 has to be published. publish: getsentry/craft@3.12.0 publish#10373 must finish first.

After merge

• Cut a release and check that the Craft log shows Requesting a temporary NuGet API key.
• Once a release has gone through, delete the NUGET_API_TOKEN secret from getsentry/publish and revoke the key on nuget.org.
• Rollback: remove trustedPublishingUser. Craft goes back to NUGET_API_TOKEN, as long as that secret still exists.

Testing

• The edited .craft.yml parses, and the nuget target picks up trustedPublishingUser.
• Nothing has run against nuget.org yet. That needs the policy above.

via Ricardo Oliveira.

--

View Session [Sentry]

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.86%. Comparing base (aebbeb2) to head (a25b72c).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5918      +/-   ##
==========================================
- Coverage   76.87%   76.86%   -0.02%     
==========================================
  Files         533      533              
  Lines       19847    19847              
  Branches     3920     3920              
==========================================
- Hits        15258    15256       -2     
- Misses       3709     3710       +1     
- Partials      880      881       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.