Repository navigation
develop pre-release publishing fails: nuget.org rejects push with 403 #1128
Description
- Version:
develop(latest published pre-release is0.6.0-pre.165, Oct 1) - Target: CI –
Build and Publishworkflow,2 / Publishjob
Problem
No ElectronNET.Core pre-release has been published from develop since 0.6.0-pre.165 (Oct 1), so changes merged since then (#1116–#1125) aren't available as packages.
The two most recent develop runs pass the integration tests, then fail in the PublishPackages Nuke target when pushing to nuget.org:
Forbidden https://www.nuget.org/api/v2/package/
error: Response status code does not indicate success: 403 (The specified API key is invalid, has expired, or does not have permission to access the specified package.).
Target "PublishPackages" has thrown an exception
- https://github.com/ElectronNET/Electron.NET/actions/runs/42004877216 (Fix host hang when Electron exits before the socket bridge connects #1124)
- https://github.com/ElectronNET/Electron.NET/actions/runs/41983032478 (Fix Electron startup failure caused by the Host lockfile #1125)
The develop runs before that (Oct 18 – Oct 27) failed earlier in integration tests, so Publish never ran and it isn't clear when the key stopped working.
Suggested fix
Rather than generating a new NUGET_API_KEY secret, switch to nuget.org Trusted Publishing, which nuget.org now recommends over API keys for GitHub Actions.
This needs:
- A Trusted Publishing policy on nuget.org, created by the account or organization that owns the
ElectronNET.Core*packages, for repositoryElectronNET/Electron.NETand workflow fileBuild and Publish.yml. - A workflow change to request the temporary key in the
Publishjob.
Why it matters
Pre-releases are the only way to consume develop fixes without building Electron.NET locally.
Activity
FlorianRappl commentedon Nov 10, 2026
@GregorBiswanger has been notified already. I'm sure he will either set up the trusted publishing or renew the key soon.
Closed in favor of #1129
GregorBiswanger commentedon Nov 10, 2026
Update: PR #1129 is merged as 4eeb98a. The nuget.org Trusted Publishing policy is now active for ElectronNET/Electron.NET → Build and Publish.yml, scoped to new versions of existing ElectronNET.Core* packages; NUGET_USER was already configured. The workflow uses NuGet/login@v1 to exchange GitHub OIDC for a short-lived key.
The first post-merge develop run (#175) did not reach Publish: Integration-Tests failed with Electron startup timeouts on ubuntu-24.04/Electron 30.4.0 and a macOS 26 test failure, while the macos-14 runner configuration is unsupported. Retrying the failed jobs left the gate failed, so the Publish job was skipped and no package was released. The old NUGET_API_KEY secret is retained until Trusted Publishing succeeds end to end.
Workflow run: https://github.com/ElectronNET/Electron.NET/actions/runs/42874033087
FlorianRappl commentedon Nov 10, 2026
Works again:
https://github.com/ElectronNET/Electron.NET/actions/runs/42877259692/job/130046745988