GitLab CI OIDC trust relationships | Changelog

Depot now supports OIDC trust relationships for GitLab CI. You can configure a Depot project to trust a GitLab namespace and project, then use GitLab's short-lived ID tokens to authenticate depot build without storing a static Depot token in CI variables.

In your GitLab job, request an ID token named DEPOT_OIDC_TOKEN with aud: https://depot.dev; the Depot CLI will exchange it automatically when it runs in GitLab CI.

build-image:
  id_tokens:
    DEPOT_OIDC_TOKEN:
      aud: https://depot.dev
  script:
    - depot build .

See the GitLab CI integration guide and OIDC trust relationship docs for setup steps.