Add the ability to use Trusted Publishing for NuGet publish instead of an API key (OSOE-1290)

[Piedone]

NuGet now has something called Trusted Publishing that you can use instead of preconfigured long-living API keys. This is more secure and needs no maintenance (the at most yearly regeneration of API keys) but needs changes to the publishing workflow and the creation of Trusted Publishing Policies for every repository.

For now, it's a question whether there will be a better way than having to create a Trusted Publishing Policy for every repository: NuGet/NuGetGallery#10896.

• Extend the publish-nuget workflow and action with the option to use Trusted Publishing. The API key-based publishing should still be available, but it needs to be documented that the recommended approach is Trusted Publishing.
• Make Trusted Publishing the new default in https://github.com/Lombiq/Open-source-template.
• Change all OSOCE projects to use Trusted Publishing. The Policies need to be created from under the shared user, since when an organization member user creates it then it becomes inactive if the user is removed from the org, despite the Policy being owned by the org.

Jira issue

[BenedekFarkas]

it needs to be documented that the recommended approach is Trusted Publishing.

I'd also add a warning to the build output, like the one about NodeJS version deprecation.

[Piedone]

There's a further issue, Trusted Publishing policies are tied to a user: NuGet/NuGetGallery#10581. So, we'd need a to use a shared user to create them.

[BenedekFarkas]

What's the issue exactly? Our packages are owned by a technical user already.

[Piedone]

That's not a technical user but an organization. We do have a technical user but every aspect of publishing you can manage from under your own account as an organization admin, Trusted Publishing policies are not like that.

[Piedone]

An attempt at this in OC: OrchardCMS/OrchardCore#19744.