rickub/feedback · #5

Hi,
I'm migrating open source repositories from GitHub to rickub (the Bloggrify project, a set of npm packages under the @bloggrify scope). One thing is blocking me from moving the release pipeline: OIDC-based authentication from CI jobs.
What I'm referring to: on GitHub Actions, a workflow job can request an OIDC id-token (permissions: id-token: write). This is a short-lived signed JWT whose claims identify the repository, workflow and ref that is running. External services verify it against the provider's issuer and grant access without any long-lived credential stored as a secret. The main use case for me is npm "trusted publishing":
npmjs.com lets you declare a CI workflow as a trusted publisher for a package, and npm publish then works with no npm token at all, with provenance attestations as a bonus. The same mechanism is used by PyPI, and for assuming AWS/GCP roles from CI.

I didn't find anything about this in the Actions documentation, so my questions are:

Does rickub Actions currently expose OIDC id-tokens to workflow jobs (even undocumented)?
2.If not, is it on the roadmap?
3.The other half of the problem is registry-side: npm currently only recognizes GitHub Actions and GitLab CI as trusted publishing providers. Are there plans to get rickub listed as a supported provider with npm (and possibly PyPI)?

In the meantime I'm keeping my npm releases running on a GitHub mirror, so this is not urgent, but it's the last dependency preventing a complete migration.

Thanks

Does rickub Actions support OIDC id-tokens (for npm trusted publishing)? #5