Advanced .NET Skills Available in the dotnet-advanced Plugin

The dotnet-advanced plugin provides three specialized skills—NuGet Trusted Publishing, P/Invoke interoperability, and C# scripting—that enable secure package publishing, native library integration, and lightweight automation in .NET projects.

The dotnet/skills repository hosts the dotnet-advanced plugin, a modular extension that delivers advanced .NET skills for specialized development scenarios not covered by the core tooling. Each skill operates as a self-contained knowledge unit residing in its own subdirectory under plugins/dotnet-advanced/skills/, accompanied by a comprehensive SKILL.md file and optional reference materials.

NuGet Trusted Publishing with OIDC

The nuget-trusted-publishing skill eliminates long-lived API keys by implementing OpenID Connect (OIDC) authentication for NuGet.org. As documented in plugins/dotnet-advanced/skills/nuget-trusted-publishing/SKILL.md, this approach uses short-lived tokens exchanged via GitHub Actions workflows, replacing permanent secrets like secrets.NUGET_API_KEY with ephemeral credentials.

Configuring the GitHub Actions Workflow

To implement trusted publishing, configure your repository workflow with id-token: write permissions and utilize the NuGet login action. The workflow triggers on version tags and authenticates directly with NuGet.org using OIDC:

# .github/workflows/publish.yml

name: Publish
on:
  push:
    tags: 'v*.*.*'

permissions:
  contents: read
  id-token: write   # 👈 required for OIDC

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: release
    steps:
    - uses: actions/checkout@v4
    - name: Set up .NET
      uses: actions/setup-dotnet@v3
      with:
        dotnet-version: '8.0.x'
    - name: Pack
      run: dotnet pack -c Release -o ./artifacts
    - name: NuGet login (OIDC)
      id: login
      uses: NuGet/login@v1
      with:
        user: ${{ secrets.NUGET_USER }}
    - name: Push package
      run: dotnet nuget push ./artifacts/*.nupkg --source https://api.nuget.org/v3/index.json \
           --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --skip-duplicate

Native Interop with P/Invoke and LibraryImport

The dotnet-pinvoke skill provides comprehensive guidance for declaring and consuming native C/C++ libraries from .NET code. Located at plugins/dotnet-advanced/skills/dotnet-pinvoke/SKILL.md, this skill covers type-mapping, string marshalling, memory-ownership patterns, SafeHandle usage, and callback interop for Windows, Linux, and macOS platforms.

Source-Generated Interop for AOT Compatibility

Modern .NET projects should prefer [LibraryImport] over legacy [DllImport] for trim-safe, ahead-of-time (AOT) compatible native calls. This source generator eliminates runtime marshalling overhead while ensuring correct type sizes and encoding:

using System.Runtime.InteropServices;

internal static partial class NativeMethods
{
    // LibraryImport (preferred for .NET 7+)
    [LibraryImport("mylib", StringMarshalling = StringMarshalling.Utf8,
                   SetLastPInvokeError = true)]
    internal static partial int ProcessRecords(
        [In] Record[] records,
        nuint count,
        out uint outProcessed);
}

C# Scripting for Rapid Prototyping

The csharp-scripts skill demonstrates how to author and execute C# scripts (.csx) using dotnet script or csi (C# Interactive). According to plugins/dotnet-advanced/skills/csharp-scripts/SKILL.md, these scripts support NuGet package references via #r directives and provide a lightweight alternative to full project scaffolding for automation and prototyping tasks.

Build Automation with CSX Files

Scripts can reference MSBuild assemblies directly to perform project evaluations and builds without creating permanent project files:

#r "nuget: Microsoft.Build, 17.7.0"

using Microsoft.Build.Evaluation;

var project = new Project("MyApp.csproj");
project.SetProperty("Configuration", "Release");
project.Build();
Console.WriteLine("Build succeeded");

Plugin Architecture and File Structure

The dotnet-advanced plugin follows a strict modular design defined in plugins/dotnet-advanced/plugin.json. This manifest declares the plugin metadata and root skills folder, enabling the assistant to load only relevant knowledge domains. Each skill maintains its own directory containing:

• SKILL.md - Primary documentation and walkthroughs
• references/*.md - Supporting technical details (type-mapping tables, workflow templates, diagnostic guides)

This isolation keeps advanced capabilities separate from core skills while maintaining discoverability through the plugin system.

Summary

• NuGet Trusted Publishing replaces permanent API keys with OIDC tokens via GitHub Actions integration, configured in plugins/dotnet-advanced/skills/nuget-trusted-publishing/.

• P/Invoke Skill bridges native and managed code using [LibraryImport] for AOT-safe interoperability, covering marshalling and memory safety.

• C# Scripting enables rapid automation through .csx file execution with full NuGet package support.

• Modular Design isolates each capability in dedicated folders under plugins/dotnet-advanced/skills/, loaded on-demand via plugin.json.

Frequently Asked Questions

What is the difference between the dotnet and dotnet-advanced plugins?

The core dotnet plugin provides fundamental .NET development guidance, while dotnet-advanced targets niche scenarios requiring specialized knowledge such as OIDC authentication, native interop, and scripting workflows.

How does LibraryImport improve upon DllImport?

[LibraryImport] is a source generator that produces trim-safe, ahead-of-time compatible marshalling code at compile time, eliminating runtime overhead and preventing common bugs related to type sizes and string encoding that occur with runtime [DllImport] marshalling.

Can C# scripts reference NuGet packages?

Yes, C# scripts support NuGet package references using the #r "nuget: PackageName, Version" directive, allowing scripts to consume libraries like Microsoft.Build without a project file or restore step.

Is NuGet Trusted Publishing supported outside GitHub Actions?

While the skill focuses on GitHub Actions integration using OIDC, NuGet Trusted Publishing supports any OIDC-compliant provider. The specific workflow configuration in nuget-trusted-publishing/SKILL.md targets GitHub's implementation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}