OIDC trusted publishing is a release method that lets a CI/CD workflow obtain a short-lived identity token from an OpenID Connect provider and use it to publish a package, artifact, or container image. Instead of storing a long-lived secret such as an API key or npm token in the repository, the build system proves its identity at release time and receives temporary publishing rights.
This matters because it reduces the value of stolen credentials and limits how long a compromised workflow can publish malicious software. In real attacks, an attacker who gains access to a maintainer repository or build pipeline may try to abuse the trusted publishing path to ship a tampered release while still appearing legitimate. In defense, security teams pair OIDC publishing with branch protection, least-privilege workflow permissions, approval gates, and log review. OIDC improves release security, but it does not guarantee the code being published is safe; it only makes the credential side of the pipeline harder to abuse.