Contribution

• I'd be willing to implement this feature (contributing guide)

Describe the user story

Trusted publishing is an important security feature that prevents leaking long-lived publishing tokens from workflows. The npmjs registry supports it, so it's important that it works throughout the ecosystem.

Describe the solution you'd like

Now that npmjs.com & the npm client support OIDC publishing, the pnpm client should follow suit.

Describe the drawbacks of your solution

• Requires implementation, maintenance, etc
• Locks publishers into GitHub/GitLab

Describe alternatives you've considered

Don't implement it-which, for better and for worse, will look insecure on our part, especially once Yarn or Bun implement it.

Related

#8897 (comment)