What the developer wrote
Authored by Nicolas Dorier
Add PushNuget.sh
What changed, and why it matters
This commit adds a simple build-and-publish helper script for the project's NuGet package. It packages the BTCPayServer.Client library, pushes it to the public NuGet registry using an API key from an environment variable, and creates a matching Git tag. There is no indication this change fixes or introduces a security issue; it is a routine developer tooling addition.
No security action required. As a general hygiene note, ensure CI/CD secrets (NUGET_API_KEY) are stored in a protected secrets manager and that tag push permissions are restricted to release automation.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The new shell script (BTCPayServer.Client/PushNuget.sh) automates release of the BTCPayServer.Client NuGet package: it cleans bin/Release, runs dotnet pack, locates the produced .nupkg, pushes it to nuget.org with NUGET_API_KEY, derives the version from the filename, and tags/pushes the tag to origin. The script uses set -euo pipefail and treats the API key as an environment variable, which is standard practice. No code behavior of the application itself is changed.
Changed components
BTCPayServer.Client/PushNuget.shInspect captured patch +16 / −0
### BTCPayServer.Client/PushNuget.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+set -euo pipefail
+
+rm -rf "bin/Release/"
+dotnet pack --configuration Release --include-symbols -p:SymbolPackageFormat=snupkg
+
+package=$(find ./bin/Release -name "BTCPayServer.Client.*.nupkg" -type f -print -quit)
+if [[ -z "$package" ]]; then
+ echo "BTCPayServer.Client package not found" >&2
+ exit 1
+fi
+
+dotnet nuget push "$package" --source "https://api.nuget.org/v3/index.json" --api-key "$NUGET_API_KEY"
+ver=$(basename "$package" | sed -E 's/BTCPayServer\.Client\.([0-9]+(\.[0-9]+){1,3})\.nupkg/\1/')
+git tag -a "BTCPayServer.Client/v$ver" -m "BTCPayServer.Client/$ver"
+git push origin "BTCPayServer.Client/v$ver"Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.