dotnet nuget push fails to authenticate

Description

I can’t get authentication to work after reading the README section and related issues (https://github.com/NuGet/Home/issues/8580#issuecomment-599056152).

I want to:

1. restore dependencies from nuget.org
2. publish a package to GPR

Details

I have a nuget.config in my repo with just the source I need to restore dependencies.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget" value="https://api.nuget.org/v3/index.json" />
  </packageSources>
</configuration>

Then I added the bit of yaml that configures the GPR source-url and adds authentication.

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - uses: actions/setup-dotnet@v1
      with:
        source-url: https://nuget.pkg.github.com/stevenliekens/index.json
      env:
        NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - run: dotnet pack --configuration Release --output artifacts --version-suffix CI-$(date --utc '+%Y%m%d-%H%M%S')
    - run: dotnet nuget push artifacts/*.nupkg

No matter what I do, I get an error on the last step saying that my API key is missing.

warn : No API Key was provided and no API Key could be found for ‘https://nuget.pkg.github.com/stevenliekens’. To save an API Key for a source use the ‘setApiKey’ command.

Can this be a bug in the action? I don’t see what I could possibly be missing.

[ZEisinger]

It seems the original problem with not using the given token would be solved by #109 (not released in v1 yet). The nuget file was being generated into a temp folder outside the repo path and was not being used.

[sliekens]

My conclusion is that you have to do one of two things:

• A) Remove the <clear /> element from your nuget.config
• B) Add the source that requires authentication to your nuget.config

So this will never work:

    - uses: actions/setup-dotnet@v1
      with:
        config-file: nuget.config
        source-url: https://nuget.pkg.github.com/OwnerName/index.json
      env:
        NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

<!-- Will never work, even though the NUGET_AUTH_TOKEN is added, it can't be matched to a packageSource after the <clear/> -->
<configuration>
    <packageSources>
        <clear />
        <add key="nuget" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    </packageSources>
</configuration>

Option A:

<!-- Will work because packageSources are now merged with the temporary nuget.config in the parent directory -->
<configuration>
    <packageSources>
        <add key="nuget" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    </packageSources>
</configuration>

Option B:

<!-- Will also work because setup-dotnet will match your existing packageSource -->
<configuration>
    <packageSources>
        <clear />
        <add key="nuget" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
        <add key="gh" value="https://nuget.pkg.github.com/OwnerName/index.json" protocolVersion="3" />
    </packageSources>
</configuration>