@postman/sdk-config 0.11.0 → 0.13.0

package/README.md

@@ -75,15 +75,27 @@ if (!result.success) {
 SDK Config objects are strict. Unknown fields, duplicate language targets, incompatible package
 publication settings, and non-exact generator versions are rejected. npm and crates use
 `output.publish.token`, PyPI and Maven use flat `username` and `password` fields, and Maven may also
-use a complete `signature` object. Configure these fields with environment expressions such as
+use a complete `signature` object. NuGet and RubyGems use `output.publish.apiKey` to name the
+repository secret that the generated release workflow reads the API key from, such as
+`${MY_NUGET_KEY}`. That value is a secret name, never the key itself. Configure these fields with
+environment expressions such as
 `${NPM_TOKEN}` rather than literal credentials. Clients must resolve and transport credentials using
 a dedicated secret channel and remove them from generation payloads, logs, and stored artifacts.
-Fern migration preserves a credential only when the raw `generators.yml` value is exactly an
-environment expression; normalized, resolved, or literal values are omitted with a warning.
+NuGet and RubyGems may instead set `output.publish.trustedPublishing`, which authenticates the
+release workflow with a short-lived OIDC token the registry verifies against the repository. There is
+then no API key secret to name, so `apiKey` and `trustedPublishing` cannot both be set.
 
-CLI targets may also declare `output.distribution` (Homebrew and Scoop channels) and npm
-publication. Distribution credentials are GitHub Actions secret **names**, not environment
-expressions: clients must not resolve them or send them through the publish-credential channel. See
+Fern migration preserves a credential only when the raw `generators.yml` value is exactly an
+environment expression; normalized, resolved, or literal values are omitted with a warning. A GitHub
+NuGet target whose `api-key` names no secret gets `${NUGET_API_TOKEN}`, the secret Fern's generated
+workflow reads in that case, and no warning, because publishing keeps working unchanged. Fern states
+trusted publishing through the same `api-key` field, as `OIDC` or `<USE_OIDC>`, and migration maps
+either to `trustedPublishing: true` rather than dropping it.
+
+CLI targets may also declare `output.distribution` (Homebrew and Scoop channels and
+`githubAttestations` for release build provenance) and npm publication. Distribution credentials are
+GitHub Actions secret **names**, not environment expressions: clients must not resolve them or send
+them through the publish-credential channel. See
 [CLI distribution and npm publication](src/sdk-config/v1/README.md#cli-distribution-and-npm-publication).
 Call `getSdkConfigV1Diagnostics` after validation to surface non-fatal warnings.