Add GitLab OIDC provider support

[tachyons]

The changes add GitLab as a new OIDC trusted publisher, allowing gem publishing from GitLab CI/CD pipelines.

Goals:

• Add GitLab CI as the supported OIDC provider

Non Goals for this iteration

• Support for self managed instances
• Attestation support

stages:
  - deploy

variables:
  GEM_HOST_URL: "https://rubygems.org"

publish:
  stage: deploy
  image: ruby:3.2
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://rubygems.org
  script:
    - gem install bundler
    - bundle install
    - |
      API_TOKEN=$(ruby -rnet/http -rjson -e "
        uri = URI('${GEM_HOST_URL}/api/v1/oidc/trusted_publisher/exchange_token')
        res = Net::HTTP.post(uri, {jwt: ENV['GITLAB_OIDC_TOKEN']}.to_json, {'Content-Type' => 'application/json'})
        data = JSON.parse(res.body)
        if (res.code == '200' || res.code == '201') && data['rubygems_api_key']
          puts data['rubygems_api_key']
        else
          STDERR.puts 'Token exchange failed: ' + res.body; exit 1
        end
      ")
    - gem build my_gem.gemspec
    - mkdir -p ~/.gem
    - |
      cat > ~/.gem/credentials <<EOF
      ---
      :rubygems_api_key: rubygems_api_key
      ${GEM_HOST_URL}: ${API_TOKEN}
      EOF
    - chmod 0600 ~/.gem/credentials
    - gem push *.gem --host ${GEM_HOST_URL}
  only:
    - tags

Screenshots

Prior art

1. NPM

2. PyPI

[codecov]

Codecov Report

❌ Patch coverage is 68.10811% with 59 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.02%. Comparing base (2b4f35a) to head (c494cf9).
⚠️ Report is 222 commits behind head on master.

Files with missing lines	Patch %	Lines
...s/oidc/trusted_publisher/gitlab/table_component.rb	0.00%	23 Missing ⚠️
...ts/oidc/trusted_publisher/gitlab/form_component.rb	0.00%	21 Missing ⚠️
app/models/oidc/trusted_publisher/gitlab.rb	93.67%	5 Missing ⚠️
app/models/oidc/provider.rb	50.00%	3 Missing ⚠️
...lers/oidc/pending_trusted_publishers_controller.rb	75.00%	2 Missing ⚠️
...lers/oidc/rubygem_trusted_publishers_controller.rb	85.71%	2 Missing ⚠️
app/helpers/rubygems_helper.rb	0.00%	1 Missing ⚠️
.../views/oidc/pending_trusted_publishers/new_view.rb	91.66%	1 Missing ⚠️
.../views/oidc/rubygem_trusted_publishers/new_view.rb	93.75%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #5978      +/-   ##
==========================================
- Coverage   97.24%   94.02%   -3.22%     
==========================================
  Files         476      480       +4     
  Lines        9787    10062     +275     
==========================================
- Hits         9517     9461      -56     
- Misses        270      601     +331     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[tachyons]

@colby-swandale Hey, I am trying to add trusted publishing support with GitLab CI. I've tested the functionality with ngrok, and it is working fine.

Before adding proper tests and cleaning up the code, could you please check if I am on the right path ? I tried to mimic the GitHub actions implementation as much as possible.

[colby-swandale]

Hey @tachyons apologies, I dropped the ball on following up with you on this one. I'm looking at this now.

[colby-swandale]

Reviewing the draft, I noticed it would be great to include API-level GitLab exchange coverage in the tests, as well as a graceful shutdown for the Attestation path.

[brian-penguin]

Ah shoot, sorry to complicate your PR but the redesign has left a bunch of conflicts. Are you okay with updating to match the new layout/styles?

[tachyons]

Let me try, hopefully it wouldn't be hard

[tachyons]

self review: Falling back to Github action by default to reduce path changes

[tachyons]

self review: Pre-fill some information from the repo path

[tachyons]

self review: unlike GitHub, GitLab repo path can be deeply nested

[tachyons]

self review: Taken from https://docs.gitlab.com/ci/secrets/id_token_authentication/