camp's OIDC trusted-publishing service (design and consensus: camp-index#66). A stateless Cloudflare Worker that lets plugin authors publish releases from their own CI with no token, no secrets, no fork: the author's workflow proves its identity with a signed OIDC token from its CI provider, and this service — the only credential holder in the flow — opens the release PR on camp-index.
- The author's release workflow (GitHub Actions or GitLab CI) builds
the release record with camp-tools at the tag, mints an OIDC
identity token with audience
camp-publish, and POSTs both to/publish. - The service verifies the token against the provider's published
keys and checks one authorization fact: the repository the token
was minted in is the listed source of a claimed (Tier 1+) entry,
by permanent numeric repository id (
source-repo-id). - Acting as the
camp-registry-publisherGitHub App (scoped to camp-index only), it appends the release record to the entry on a rollingrelease-request/<component>branch and opens (or updates) the PR. The maintainer is the git author; the App is the committer. - Unchanged from every other path: camp CI independently rebuilds the artifact from the public tag and verifies the record before a human merges.
- Provider is selected by the token issuer (github.com, gitlab.com) and must match the entry's listed source host.
- The numeric repo id is the hard identity; it survives renames and transfers. Id match with a differing path is a soft stop: the listing needs a repoint (a reviewed act) before publishing resumes.
- Tags only (
ref_type), public repos only, duplicate tags refused.
npm install
npm test # verification + release-append suites, no network
npm run dev # wrangler dev
Deploy: npm run deploy (Workers config in wrangler.toml; the App
private key lives only as a Worker secret, APP_PRIVATE_KEY, PKCS8).