The Gitlab Trust Provider supports attestation of Client Workloads identities in a Gitlab Jobs environment.
The GitLab Trust Provider relies OIDC (OpenID Connect) tokens issued by GitLab. These tokens contain verifiable information about the job, its origin within the project, and the associated pipeline.
Match rules
Section titled “Match rules”The following match rules are available for this Trust Provider type:
| Data | Description | Example |
|---|---|---|
| namespace_path | The group or user namespace (by path) where the repository resides. | my-group |
| project_path | The repository from where the workflow is running, using the format {group}/{project} | my-group/my-project |
| ref_path | The fully qualified reference (branch or tag) that triggered the job. (Introduced in GitLab 16.0.) |
|
| subject | The repository and Git reference from where the workflow is running. The format is project_path:{group}/{project}:ref_type:{type}:ref:{branch_name}, where type can be either branch (for a branch-triggered workflow) or tag (for a tag-triggered workflow). |
|
For additional information about GitLab ID Token claims, please refer to GitLab Token Payload.