Use repository variable for NuGet login

Author: kMutagene

.github/workflows/release-codecs.yml

@@ -64,7 +64,7 @@ jobs:
         uses: NuGet/login@v1
         id: nuget-login
         with:
-          user: ${{ secrets.NUGET_USER }}
+          user: ${{ vars.NUGET_USER }}
 
       - name: Publish Codecs to NuGet
         run: dotnet nuget push ./artifacts/packages/ValidationPackage.Codecs.*.nupkg --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate

.github/workflows/release-model.yml

@@ -64,7 +64,7 @@ jobs:
         uses: NuGet/login@v1
         id: nuget-login
         with:
-          user: ${{ secrets.NUGET_USER }}
+          user: ${{ vars.NUGET_USER }}
 
       - name: Publish Model to NuGet
         run: dotnet nuget push ./artifacts/packages/ValidationPackage.Model.*.nupkg --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate

.github/workflows/release-package.yml

@@ -29,6 +29,6 @@ jobs:
       uses: NuGet/login@v1
       id: nuget-login
       with:
-        user: ${{ secrets.NUGET_USER }}
+        user: ${{ vars.NUGET_USER }}
     - name: push
       run: dotnet nuget push ./artifacts/packages/*.nupkg --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate

AGENTS.md

@@ -232,7 +232,7 @@ When adding tests:
   successful policy can publish any NuGet package owned by that account. npm
   publishers are configured per scoped package and PyPI publishers per project,
   using the exact field matrix in `docs/operations/releases.md`.
-- All package publish jobs need `id-token: write` and the `release` environment. `NuGet/login` exchanges OIDC for a temporary key; never restore a long-lived `NUGET_KEY`. `NUGET_USER` is only the nuget.org profile name associated with the policy. Reusable publishers must read it directly from their job environment because GitHub cannot pass environment secrets through `workflow_call`.
+- All package publish jobs need `id-token: write` and the `release` environment. `NuGet/login` exchanges OIDC for a temporary key; never restore a long-lived `NUGET_KEY`. `NUGET_USER` is a repository Actions variable containing only the public nuget.org profile name associated with the policy. Repository variables remain available to same-repository reusable workflows without forwarding secrets.
 - A staged package marked for publication can be pushed to the production registry after checks pass.
 - Workflow actions should remain pinned to deliberate versions/commits. Preserve least-privilege permissions and never print secrets.
 

docs/operations/releases.md

@@ -152,10 +152,10 @@ versioned so consumers can opt into portable model conversion.
 Create a protected GitHub environment named `release` in both repositories.
 Add required reviewers and allow deployments from both `dev` and `release` so
 the manually dispatched package workflows can publish reviewed preview versions
-from `dev` as well as production versions from `release`. Store one environment
-secret, `NUGET_USER`, whose value is the nuget.org profile that owns the
-trusted-publishing policies (currently `Mutagene`),
-not an email address, GitHub username, organization name, or API key.
+from `dev` as well as production versions from `release`. Create one repository
+Actions variable, `NUGET_USER`, whose value is the nuget.org profile that owns
+the trusted-publishing policies (currently `Mutagene`), not an email address,
+GitHub username, organization name, or API key.
 
 On nuget.org, select the personal account `Mutagene` as the policy owner and
 keep the NuGet packages owned by that account. NuGet policies are owner-wide:
@@ -174,10 +174,9 @@ only:
 
 The Client and Interop policy names the called reusable workflow because that
 is the workflow NuGet observes in the `job_workflow_ref` claim. The reusable
-workflow reads `NUGET_USER` directly from its `release` environment; environment
-secrets cannot be passed through `workflow_call` by the caller. The four policy
-rows distinguish trusted workflow identities, but they do not create four
-package-level scopes.
+workflow reads the `NUGET_USER` repository variable directly, so no secret needs
+to be forwarded through `workflow_call`. The four policy rows distinguish
+trusted workflow identities, but they do not create four package-level scopes.
 
 On npmjs.com, open each package's **Settings → Trusted Publisher**, select
 **GitHub Actions**, and enter:
@@ -230,8 +229,8 @@ workflows.
 
 The publish jobs request `id-token: write`. `NuGet/login` exchanges OIDC for a
 temporary API key; npm and PyPI also exchange OIDC without repository tokens.
-Store only the nuget.org profile name as `NUGET_USER`, and do not restore a
-long-lived `NUGET_KEY`, npm token, or PyPI token.
+Store only the nuget.org profile name in the `NUGET_USER` repository Actions
+variable, and do not restore a long-lived `NUGET_KEY`, npm token, or PyPI token.
 
 See the official registry instructions for
 [NuGet trusted publishing](https://learn.microsoft.com/nuget/nuget-org/trusted-publishing),