Test uv+PyPI Trusted Publishing on Gitlab (#17443)

.github/workflows/ci.yml

@@ -301,6 +301,34 @@ jobs:
           repository-url: "https://test.pypi.org/legacy/"
           packages-dir: "astral-test-pypa-gh-action/dist"
 
+      - name: "Request GitLab OIDC token for impersonation"
+        uses: digital-blueprint/gitlab-pipeline-trigger-action@20e77989b24af658ba138a0aa5291bdc657f1505 # v1.3.0
+        with:
+          host: gitlab.com
+          id: astral-test-publish/astral-test-gitlab-pypi-tp
+          ref: main
+          trigger_token: ${{ secrets.GITLAB_TEST_PUBLISH_TRIGGER_TOKEN }}
+          access_token: ${{ secrets.GITLAB_TEST_PUBLISH_ACCESS_TOKEN }}
+          download_artifacts: true
+          fail_if_no_artifacts: true
+          download_path: ./gitlab-artifacts
+
+      - name: "Load GitLab OIDC token from GitLab job artifacts"
+        id: load-gitlab-oidc-token
+        run: |
+          # we expect ./gitlab-artifacts/*/artifacts/id-token to exist
+          id_token_file=$(find ./gitlab-artifacts -type f -name id-token | head -n 1)
+          if [ -z "${id_token_file}" ]; then
+            echo "No id-token file found in GitLab artifacts"
+            exit 1
+          fi
+          GITLAB_OIDC_TOKEN=$(cat "${id_token_file}")
+
+          # Add a secret mask for the token.
+          echo "::add-mask::$GITLAB_OIDC_TOKEN"
+
+          echo "GITLAB_OIDC_TOKEN=${GITLAB_OIDC_TOKEN}" >> "${GITHUB_OUTPUT}"
+
       - name: "Add password to keyring"
         run: |
           # `keyrings.alt` contains the plaintext keyring
@@ -327,6 +355,7 @@ jobs:
           UV_TEST_PUBLISH_CLOUDSMITH_TOKEN: ${{ secrets.UV_TEST_PUBLISH_CLOUDSMITH_TOKEN }}
           UV_TEST_PUBLISH_PYX_TOKEN: ${{ secrets.UV_TEST_PUBLISH_PYX_TOKEN }}
           UV_TEST_PUBLISH_PYTHON_VERSION: ${{ env.PYTHON_VERSION }}
+          UV_TEST_PUBLISH_GITLAB_OIDC_TOKEN: ${{ steps.load-gitlab-oidc-token.outputs.GITLAB_OIDC_TOKEN }}
 
   required-checks-passed:
     name: "all required jobs passed"