Move NuGet publish to caller job for correct OIDC job_workflow_ref

Author: glennawatson

.github/workflows/release.yml

@@ -8,30 +8,42 @@ permissions:
   id-token: write
 
 jobs:
-  nuget-auth:
+  release:
+    uses: reactiveui/actions-common/.github/workflows/workflow-common-release.yml@main
+    with:
+      solutionFile: ReactiveUI.Binding.SourceGenerators.slnx
+      installWorkloads: true
+    secrets:
+      ES_USERNAME: ${{ secrets.ES_USERNAME }}
+      ES_PASSWORD: ${{ secrets.ES_PASSWORD }}
+      CREDENTIAL_ID: ${{ secrets.CREDENTIAL_ID }}
+      ES_TOTP_SECRET: ${{ secrets.ES_TOTP_SECRET }}
+
+  publish-nuget:
+    needs: release
     runs-on: ubuntu-latest
     environment:
       name: release
     permissions:
       id-token: write
-    outputs:
-      api-key: ${{ steps.login.outputs.NUGET_API_KEY }}
     steps:
+      - name: Download signed packages
+        uses: actions/download-artifact@v6
+        with:
+          name: signed-nuget
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v5
+
       - name: NuGet login (OIDC trusted publishing)
-        id: login
+        id: nuget-login
         uses: NuGet/login@v1
         with:
           user: ${{ secrets.NUGET_USER }}
 
-  release:
-    needs: nuget-auth
-    uses: reactiveui/actions-common/.github/workflows/workflow-common-release.yml@main
-    with:
-      solutionFile: ReactiveUI.Binding.SourceGenerators.slnx
-      installWorkloads: true
-    secrets:
-      ES_USERNAME: ${{ secrets.ES_USERNAME }}
-      ES_PASSWORD: ${{ secrets.ES_PASSWORD }}
-      CREDENTIAL_ID: ${{ secrets.CREDENTIAL_ID }}
-      ES_TOTP_SECRET: ${{ secrets.ES_TOTP_SECRET }}
-      NUGET_API_KEY: ${{ needs.nuget-auth.outputs.api-key }}
+      - name: Push to NuGet
+        shell: bash
+        run: |
+          for pkg in *.nupkg; do
+            dotnet nuget push "$pkg" --source https://api.nuget.org/v3/index.json --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}"
+          done