Codeberg trusted publisher

[gbrennon]

Im migration my repos to codeberg and github is already a trusted publisher to pypi so it accepts publish from here but what i want to request the same thing for codeberg(forgejo) so i can really migrate to there.

Register Codeberg domain so it can be enable as a trusted publisher

[lucsorel]

I was about to submit the same issue, but I checked the existing ones beforehand. 🙏 @gbrennon

[gbrennon]

@lucsorel lets hope that pypi do it!

[miketheman]

Please read https://discuss.python.org/t/new-oidc-providers-for-trusted-publishing/106334/5 for some context on Codeberg.

[lucsorel]

thank you @miketheman for pointing this discussion. It explains a lot about how the trusted publishing workflow should be put in place. I guess the next steps are rather on the Codeberg side.

[gbrennon]

@miketheman soon ill read this bcs im busy rn.

later ill read it :)

[gbrennon]

@miketheman i was reading about the last release that release did and there is a section about OpenId:

OpenID Connect tokens offer an alternative federated identity option which, if supported by a 3rd-party system, avoids the security risks of static, unchanging tokens. With this system, an action workflow asks Forgejo for a signed JWT, Forgejo provides it, and the external system can authenticate that incoming service calls originate from a Forgejo workflow with specific claims. Unlike the static security token approach, the trust relationship is server-to-server and any intercepted, leaked, or exfiltrated tokens have a short applicability lifetime.

With changes to both the [Forgejo Runner](https://code.forgejo.org/forgejo/runner/pulls/1232) (>v12.5.0) and [Forgejo](https://codeberg.org/forgejo/forgejo/pulls/10481) (in v15.0), Forgejo Actions will support this capability as well. [Detailed documentation](https://forgejo.org/docs/latest/user/actions/security-openid-connect/) is available to review the system architecture and support users in implementing this capability.

as codeberg runs forgejo maybe soon this will also be there.

links:

• release post: https://forgejo.org/2026-04-release-v15-0/
• forgejo actions docs about oid: https://forgejo.org/docs/latest/user/actions/security-openid-connect/