Immense.NuGet.GitHubCredentialProvider 0.0.1

nuget-github-credential-provider

NuGet authentication plugin and .NET tool for GitHub Packages. It resolves credentials from the currently authenticated GitHub CLI session instead of requiring a separate long-lived PAT in NuGet.config.

Why this exists

The immediate use case is local development against private GitHub Packages feeds without asking every developer to mint and manage a separate package token just for NuGet restore.

The project was inspired by the Azure DevOps / Azure Artifacts credential-provider model, specifically the Azure Artifacts Credential Provider. We wanted the same kind of on-demand token acquisition flow for GitHub Packages, then discovered there does not appear to be an equivalent public GitHub-specific NuGet credential provider to reuse.

How it works

The provider is intentionally opinionated:

• it only handles https://nuget.pkg.github.com/*
• it resolves the username with gh api user --hostname github.com -q .login
• it resolves the token with gh auth token --hostname github.com
• on interactive retries it makes a best-effort call to gh auth refresh --hostname github.com --scopes read:packages
• it returns the result to NuGet as Basic auth

There is no separate JSON config file.

Install

Install the tool globally:

dotnet tool install --global Immense.NuGet.GitHubCredentialProvider

The package ID is Immense.NuGet.GitHubCredentialProvider, and the installed command remains nuget-plugin-github-credential-provider.

Then authenticate GitHub CLI with package-read access:

gh auth login --hostname github.com --scopes read:packages

If you already use gh, you can refresh scopes instead:

gh auth refresh --hostname github.com --scopes read:packages

NuGet 6.13+ can discover plugins from PATH when the executable name starts with nuget-plugin-, so the global tool install is the intended install story.

Release

The project file intentionally stays at version 0.0.0. The publish workflow computes the next patch version from the latest version already published on NuGet.org, then packs and publishes that generated version from CI.

Publishing uses NuGet.org trusted publishing through GitHub Actions, so there is no long-lived NuGet API key stored in repository secrets.

Configure NuGet

Add your GitHub Packages source to NuGet.config as usual:

<configuration>
  <packageSources>
    <add key="immense" value="https://nuget.pkg.github.com/immense/index.json" />
  </packageSources>
</configuration>

The provider does not need any additional source-specific settings.

Usage

Plugin mode:

nuget-plugin-github-credential-provider -Plugin

Resolve mode for local debugging:

dotnet run --project src/Immense.NuGet.GitHubCredentialProvider -- \
  resolve --uri https://nuget.pkg.github.com/immense/index.json --json

Environment

• NUGET_GITHUB_CREDENTIAL_PROVIDER_GH_PATH - optional override for the gh executable path
• NUGET_GITHUB_CREDENTIAL_PROVIDER_LOG_PATH - optional log file path
• NUGET_GITHUB_CREDENTIAL_PROVIDER_COMMAND_TIMEOUT_SECONDS - optional timeout override for gh commands

Local commands

dotnet build NuGet.GitHubCredentialProvider.slnx
dotnet test NuGet.GitHubCredentialProvider.slnx
dotnet pack src/Immense.NuGet.GitHubCredentialProvider/Immense.NuGet.GitHubCredentialProvider.csproj -c Release