[schmitch]

Fixes #632

What changes

GitLab CI with workload identity gets a new section under Every project on a runner: a runner whose pre_build_script writes the user's NuGet configuration, ~/.nuget/NuGet/NuGet.Config, itself. Projects then need no nuget.config:

• A job with an ID token gets Forge's group feed under the key forge. The exchanged key goes in NuGetPackageSourceCredentials_forge, not in the file. A failed exchange fails the job and does not fall back.
• Any other job gets the NuGet.Config stored base64-encoded in an instance CI/CD variable, CI_NUGET_CONFIG. A value that isn't valid base64 fails the job. Without the variable, the job keeps the image's configuration.

The section also covers:

• A project's own nuget.config still takes precedence; one with <clear /> drops the runner's sources.
• An instance variable that holds credentials reaches every job of every project on every runner.
• The runner needs an executor that gives each job its own container. A shell executor shares $HOME between jobs.

The existing runner, which needs a nuget.config naming Forge in each project, stays as it is.

Changelog fragment: docs/changes/2.1.1/632.docs.md.

How it was tested

I extracted the pre_build_script from the doc's TOML block with tomllib, so the test ran the exact published text. I sourced it in mcr.microsoft.com/dotnet/sdk:10.0 under both bash -eo pipefail and sh -e. The Forge stand-in was an HTTPS mock: its token endpoint answers compact JSON like Forge, and its NuGet feeds require Basic auth. dotnet restore fetched a real package.

Case	Result
Token	config names forge; restore succeeds and sends oidc:<key>
Token, project nuget.config from step 5	restore succeeds
No token, CI_NUGET_CONFIG set	decoded file written; restore succeeds with its credentials
Token and CI_NUGET_CONFIG	token wins
Rejected token (with or without the variable)	curl 401, job fails
CI_NUGET_CONFIG not base64	base64: invalid input, job fails
Neither	the image's NuGet.Config (nuget.org) is left as is
Project nuget.config with <clear /> and another source	only that source is used

cargo xtask docs --check and cargo xtask changelog --check pass.

Web UI

None needed: this is a documentation change; the admin API is unchanged.

---

Generated by Claude Code