feat: OIDC trusted publishing — deploy from CI with no stored credential - #2173

Merged

kriszyp merged 37 commits into

mainfrom

feat/oidc-trusted-publishing

Aug 21, 2026

Commits on Aug 19, 2026

feat(security): OIDC identity token verification for trusted publishing

dawsontoth
and
claude
committed
c8c1164
feat(security): hdb_oidc_trust table and trust policy operations

dawsontoth
and
claude
committed
97e0902
feat(security): exchange_oidc_token — mint a token from a CI identity

dawsontoth
and
claude
committed
63e026c
feat(cli): exchange a CI identity for a Harper token automatically

dawsontoth
and
claude
committed
1f27a6c
refactor(security): cut comments the code can carry itself

dawsontoth
and
claude
committed
08c7ceb
fix(security): keep identity and refresh tokens out of the operations log

dawsontoth
and
claude
committed
568cfbf
refactor(security): make the OIDC core issuer-agnostic, GitHub a profile

dawsontoth
and
claude
committed
b0bfa96
test: remove the JWT keys the exchange suite writes, and share the helper

dawsontoth
and
claude
committed
7ddbf0f
feat(security): narrow a minted token to a subset of its user's operations

dawsontoth
and
claude
committed
2e2dd0c
fix(security): carry an empty operation scope instead of dropping it

dawsontoth
and
claude
committed
ff04730
fix(security): apply the token operation scope to the SQL path too

dawsontoth
and
claude
committed
4cf3881
fix(security): carry the token operation scope across credential minting

dawsontoth
and
claude
committed
b66736f
fix(security): deny a scoped token from minting a login token

dawsontoth
and
claude
committed
1e84eaf
refactor(security): extract the token-scope carry-forward into one helper

dawsontoth
and
claude
committed
9daa298
fix(security): gate the token scope on the API operation, not the handler name

dawsontoth
and
claude
committed
86799c2
fix(security): gate the token scope on the job op for non-SQL export jobs too

dawsontoth
and
claude
committed
c8d429b
fix(cli): drop an unused path import left by the rebase conflict resolution

dawsontoth
and
claude
committed
a0d4e62
fix(security): harden token scoping per deep-review (4 findings)

dawsontoth
and
claude
committed
d8740b7
fix(security): close credential-minting, scope, and lifetime gaps from review

dawsontoth
and
claude
committed
41042ec
fix(security): key replay on the signed input, and fix issuer/audience matching

dawsontoth
and
claude
committed
2afa5a6
fix(security): bootstrap the replay table and carry the job's real operation

dawsontoth
and
claude
committed
562fa75
fix(security): reject a non-boolean `enabled`, and pin exact claim matching

dawsontoth
and
claude
committed
0286fb7
fix(security): act on the SQL permission denial processAST was discarding

dawsontoth
and
claude
committed
db6a5a9
refactor: split the processAST guard fix out to its own PR (#2202)

dawsontoth
and
claude
committed
6487950
fix(security): never read the SQL scope's operation from the request body

dawsontoth
and
claude
committed
602cdc6
fix(upgrade): patch is_hash_attribute on the replay table; pin the enabled strictness

dawsontoth
and
claude
committed
42315f8
docs(upgrade): record the TTL-on-first-use limitation for the replay table

dawsontoth
and
claude
committed
ce1f999
test: assert the export-job scope gate enforces, not just computes

dawsontoth
and
claude
committed
14bcc6f
test: make the #2202 ordering constraint fail loudly instead of living in a comment

dawsontoth
and
claude
committed
ced27a5
test: decouple the #2202 tripwire from the status literal it watches

dawsontoth
and
claude
committed
10256f4
fix(security): refuse malformed stored policies; let exchange_oidc_token keep its token

dawsontoth
and
claude
committed
9c322ed
fix(security): back off after a failed JWKS refresh; stop overclaiming registry support

dawsontoth
and
claude
committed
2ebb8e0
fix(security): apply the JWKS backoff to an issuer with no cached keys

dawsontoth
and
claude
committed
d8d826c
fix(security): tell the truth in list_oidc_trust; pin the guards the tests missed

dawsontoth
and
claude
committed
be34107
fix(security): report a deleted or deactivated policy user in list_oidc_trust

dawsontoth
and
claude
committed
9436f50
test: pin the invalid_reason precedence a row with both problems relies on

dawsontoth
and
claude
committed
d5a1821
test: pin the stale-key grace ceiling with an injected clock

dawsontoth
and
claude
committed
5da87ee