Trusted Publishers for Organizations

Organizations can now nominate trusted publishers, so a CI workflow can push to a repository without a long-lived write token stored in a secret.

A trusted publisher is registered against the workflow identity itself. At push time MEGA verifies the workflow's OIDC token against the registered issuer, repository, and reference, and mints a short-lived credential scoped to exactly the repositories the publisher is allowed to write. Nothing durable is stored on the CI side.

This pairs with the rest of the organization security surface — SSO, SCIM provisioning, resource groups, and network policies — and every mint is written to the organization audit log.

Configure publishers under your organization's Settings → Advanced security.