Trusted Publishing support for GitLab CI

[Turbo87]

Similar to GitHub Actions, GitLab CI also supports OIDC authentication (see https://docs.gitlab.com/ci/secrets/id_token_authentication/). This issue tracks the work that is necessary to build Trusted Publishing support for it.

Steps

• Implement backend support in crates.io
  • Add database table for GitLab CI trusted publishing configs (database: Add trustpub_configs_gitlab table #11988)
  • Adjust token exchange API endpoint to support GitLab CI OIDC authentication (trustpub/tokens/exchange: Implement GitLab CI support #12026)
  • Implement API endpoint to create GitLab CI trusted publishing configs (incl. email notification) (trustpub: Implement POST /api/v1/trusted_publishing/gitlab_configs API endpoint #12268)
  • Implement API endpoint to delete GitLab CI trusted publishing config (incl. email notification)
  • Implement API endpoint to list GitLab CI trusted publishing configs
  • Adjust trustpub_config_created/deleted emails to support GitLab CI configurations (trustpub/emails: Add support for GitLab configs #12048)
  • Adjust SendPublishNotifications background job to show GitLab CI information
• Implement frontend UI in crates.io
  • Adjust trusted publishing configs list to include GitLab CI configs
  • Adjust trusted publishing config creation form to support GitLab CI configs
  • Implement button to delete GitLab CI trusted publishing configs
  • Adjust version model to support GitLab CI in trustpubPublisher and trustpubUrl fields
  • Adjust VersionList component to show GitLab icons
  • Write documentation for the Trusted Publishing feature
• Figure out how to use it on the GitLab CI side

Related

• crates.io: Trusted Publishing Support rfcs#3691
• Tracking Issue for "Trusted Publishing Support" #10247

[tachyons]

Hey @Turbo87

GitLab Engineer here, We created an internal issue to keep track of this work and bridge the gaps. Feel free to reach out to us incase you need anything from GitLab's end

[Turbo87]

sweet, thank you!

there is some discussion happening in #11988 regarding ways to avoid resurrection attacks. would be great if you could have a quick look to check we haven't missed or misunderstood anything :)

[tachyons]

I forgot to link our internal issue here: https://gitlab.com/gitlab-org/gitlab/-/issues/572760