From 80dffa77242e397e046a86dc3a5dbe8d4b9cce41 Mon Sep 17 00:00:00 2001
From: Nick Gallegos <nick.gallegos@particular.net>
Date: Wed, 23 Sep 2026 07:30:48 -0600
Subject: [PATCH] Convert push-nuget-packages workflow to an action

---
 .../actions/push-nuget-packages/action.yml    | 49 +++++++++++++++++++
 .github/workflows/push-nuget-packages.yml     | 48 ------------------
 2 files changed, 49 insertions(+), 48 deletions(-)
 create mode 100644 .github/actions/push-nuget-packages/action.yml
 delete mode 100644 .github/workflows/push-nuget-packages.yml

diff --git a/.github/actions/push-nuget-packages/action.yml b/.github/actions/push-nuget-packages/action.yml
new file mode 100644
index 0000000..9d09da9
--- /dev/null
+++ b/.github/actions/push-nuget-packages/action.yml
@@ -0,0 +1,49 @@
+name: Push NuGet Packages
+description: Downloads .nupkg release assets and publishes them to a NuGet feed using OIDC trusted publishing
+inputs:
+  version:
+    required: true
+    description: Release tag to download package assets from
+  exclude-package-pattern:
+    required: false
+    default: ''
+    description: Glob pattern of package filenames to exclude from the push
+  nuget-user:
+    required: true
+    description: NuGet trusted publishing user
+  nuget-source-domain:
+    required: true
+    description: NuGet feed domain used for both the trusted-publishing token service and the package source
+runs:
+  using: composite
+  steps:
+    - name: Setup .NET SDK
+      uses: actions/setup-dotnet@v6
+      with:
+        dotnet-version: 'latest'
+    - name: Download assets from release
+      shell: pwsh
+      run: |
+        gh release download "${{ inputs.version }}" --repo "${{ github.repository }}" --pattern "*.nupkg" --dir nugets
+      env:
+        GH_TOKEN: ${{ github.token }}
+    - name: Get NuGet trusted publishing API key
+      uses: NuGet/login@v1
+      id: login
+      with:
+        user: ${{ inputs.nuget-user }}
+        token-service-url: ${{ inputs.nuget-source-domain }}/api/v2/token
+        audience: ${{ inputs.nuget-source-domain }}
+    - name: Push NuGet packages to production feed
+      shell: pwsh
+      run: |
+        $getChildItemParams = @{ Path = 'nugets/*'; Include = '*.nupkg' }
+        $excludePattern = "${{ inputs.exclude-package-pattern }}"
+        if ($excludePattern) { $getChildItemParams.Exclude = $excludePattern }
+        $packages = Get-ChildItem @getChildItemParams
+        Write-Output "Pushing $($packages.Count) NuGet package(s) to ${{ inputs.nuget-source-domain }}:"
+        $packages | ForEach-Object { Write-Output " - $($_.Name)" }
+        foreach ($package in $packages)
+        {
+          dotnet nuget push $package.FullName --source ${{ inputs.nuget-source-domain }}/api/v2/package --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
+        }
diff --git a/.github/workflows/push-nuget-packages.yml b/.github/workflows/push-nuget-packages.yml
deleted file mode 100644
index 19face1..0000000
--- a/.github/workflows/push-nuget-packages.yml
+++ /dev/null
@@ -1,48 +0,0 @@
-name: Push NuGet Packages
-on:
-  workflow_call:
-    inputs:
-      version:
-        required: true
-        type: string
-      exclude-package-pattern:
-        required: false
-        type: string
-        default: ''
-jobs:
-  push-nuget-packages:
-    permissions:
-      id-token: write
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: pwsh
-    steps:
-      - name: Setup .NET SDK
-        uses: actions/setup-dotnet@v6
-        with:
-          dotnet-version: 'latest'
-      - name: Download assets from release
-        run: |
-          gh release download "${{ inputs.version }}" --repo "${{ github.repository }}" --pattern "*.nupkg" --dir nugets
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Get NuGet trusted publishing API key
-        uses: NuGet/login@v1
-        id: login
-        with:
-          user: ${{ secrets.TEST_NUGET_USER }}
-          token-service-url: ${{ vars.NUGET_SOURCE_DOMAIN }}/api/v2/token
-          audience: ${{ vars.NUGET_SOURCE_DOMAIN }}
-      - name: Push NuGet packages to production feed
-        run: |
-          $getChildItemParams = @{ Path = 'nugets/*'; Include = '*.nupkg' }
-          $excludePattern = "${{ inputs.exclude-package-pattern }}"
-          if ($excludePattern) { $getChildItemParams.Exclude = $excludePattern }
-          $packages = Get-ChildItem @getChildItemParams
-          Write-Output "Pushing $($packages.Count) NuGet package(s) to ${{ vars.NUGET_SOURCE_DOMAIN }}:"
-          $packages | ForEach-Object { Write-Output " - $($_.Name)" }
-          foreach ($package in $packages)
-          {
-            dotnet nuget push $package.FullName --source ${{ vars.NUGET_SOURCE_DOMAIN }}/api/v2/package --api-key ${{steps.login.outputs.NUGET_API_KEY}}
-          }