Trusted Publishing support for GitLab CI

[Turbo87]

Similar to GitHub Actions, GitLab CI also supports OIDC authentication (see https://docs.gitlab.com/ci/secrets/id_token_authentication/). This issue tracks the work that is necessary to build Trusted Publishing support for it.

Steps

• Implement backend support in crates.io
  • Add database table for GitLab CI trusted publishing configs (database: Add trustpub_configs_gitlab table #11988)
  • Adjust token exchange API endpoint to support GitLab CI OIDC authentication
  • Implement API endpoint to create GitLab CI trusted publishing configs (incl. email notification)
  • Implement API endpoint to delete GitLab CI trusted publishing config (incl. email notification)
  • Implement API endpoint to list GitLab CI trusted publishing configs
• Implement frontend UI in crates.io
  • Adjust trusted publishing configs list to include GitLab CI configs
  • Adjust trusted publishing config creation form to support GitLab CI configs
  • Implement button to delete GitLab CI trusted publishing configs
  • Write documentation for the Trusted Publishing feature
• Figure out how to use it on the GitLab CI side

Related

• crates.io: Trusted Publishing Support rfcs#3691
• Tracking Issue for "Trusted Publishing Support" #10247