@@ -0,0 +1,69 @@
+# Copyright 2026 the adbcbridge authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Publish a tagged release's NuGet package to nuget.org through trusted
+# publishing (short-lived API key from NuGet/login, no stored secret).  Needs, on
+# nuget.org, a trusted publishing policy for repository owner "singhpratech",
+# repository "adbcbridge", workflow "publish-nuget.yml", environment "nuget" --
+# and a GitHub environment named "nuget" on this repository.  Run by hand with
+# the tag once the Release workflow has published that tag; the nuget.org user
+# name is the account that owns the policy.
+
+name: Publish to NuGet
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Published release tag, e.g. v0.1.0"
+        required: true
+      nuget_user:
+        description: "nuget.org user name that owns the trusted publishing policy"
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  nuget:
+    name: Publish ${{ inputs.tag }}
+    runs-on: ubuntu-latest
+    environment: nuget
+    permissions:
+      id-token: write
+      contents: read
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Fetch the package from the release
+        run: |
+          mkdir -p dist && cd dist
+          gh release download "${{ inputs.tag }}" --repo "${{ github.repository }}" --pattern '*.nupkg'
+          ls -l
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '8.0.x'
+      - name: Get a short-lived API key from nuget.org
+        id: login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ inputs.nuget_user }}
+      - name: Push
+        run: |
+          dotnet nuget push dist/*.nupkg \
+            --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" \
+            --source https://api.nuget.org/v3/index.json \
+            --skip-duplicate