Trusted Publishing support for GitLab CI

[Turbo87]

Similar to GitHub Actions, GitLab CI also supports OIDC authentication (see https://docs.gitlab.com/ci/secrets/id_token_authentication/). This issue tracks the work that is necessary to build Trusted Publishing support for it.

Steps

• Implement backend support in crates.io
  • Add database table for GitLab CI trusted publishing configs (database: Add trustpub_configs_gitlab table #11988)
  • Adjust token exchange API endpoint to support GitLab CI OIDC authentication (trustpub/tokens/exchange: Implement GitLab CI support #12026)
  • Implement API endpoint to create GitLab CI trusted publishing configs (incl. email notification) (trustpub: Implement POST /api/v1/trusted_publishing/gitlab_configs API endpoint #12268)
  • Implement API endpoint to delete GitLab CI trusted publishing config (incl. email notification) (trustpub: Implement DELETE /api/v1/trusted_publishing/gitlab_configs API endpoint #12285)
  • Implement API endpoint to list GitLab CI trusted publishing configs (trustpub: Implement GET /api/v1/trusted_publishing/gitlab_configs API endpoint #12292)
  • Adjust trustpub_config_created/deleted emails to support GitLab CI configurations (trustpub/emails: Add support for GitLab configs #12048)
  • Adjust SendPublishNotifications background job to show GitLab CI information (Add GitLab CI/CD support to publish notifications #12312)
• Implement frontend UI in crates.io
  • Adjust trusted publishing configs list to include GitLab CI configs (trustpub: Implement user interface for GitLab support #12335)
  • Implement button to delete GitLab CI trusted publishing configs (trustpub: Implement user interface for GitLab support #12335)
  • Adjust trusted publishing config creation form to support GitLab CI configs (trustpub: Implement user interface for GitLab support #12335)
  • Adjust version model to support GitLab CI in trustpubPublisher and trustpubUrl fields (trustpub: Show "via GitLab" in versions list #12345)
  • Adjust VersionList component to show GitLab icons (trustpub: Show "via GitLab" in versions list #12345)
  • Write documentation for the Trusted Publishing feature (docs/trusted-publishing: Add GitLab CI/CD support #12346)
• Figure out how to use it on the GitLab CI side
• Run a public beta period for a couple of weeks before declaring this feature stable

Related

• crates.io: Trusted Publishing Support rfcs#3691
• Tracking Issue for "Trusted Publishing Support" #10247

[tachyons]

Hey @Turbo87

GitLab Engineer here, We created an internal issue to keep track of this work and bridge the gaps. Feel free to reach out to us incase you need anything from GitLab's end

[Turbo87]

sweet, thank you!

there is some discussion happening in #11988 regarding ways to avoid resurrection attacks. would be great if you could have a quick look to check we haven't missed or misunderstood anything :)

[tachyons]

I forgot to link our internal issue here: https://gitlab.com/gitlab-org/gitlab/-/issues/572760