feat: adds buildkite to trust command

[sj26]

Follows the pattern established in #8909 to add Buildkite to npm's trusted publishing support on the CLI side. This would allow publishing npm packages from Buildkite pipelines with OIDC credentials, with appropriate npm registry support.

Buildkite supports generating OIDC tokens with several claims:

https://buildkite.com/docs/agent/cli/reference/oidc

The equivalent to GitHub owner, repository and workflow file is a Buildkite organization and pipeline. One repository can have many pipelines, and each pipeline can have unique steps, so sensitive actions like deploys or releases can be locked down into particular pipelines with strong access controls. Additional claims can be requested and authorized against for more complex workflows, or to use unique IDs to prevent things like name takeovers, but given the level of claim support and interrogation for other provides this seems like a reasonable starting point.

Here's an example of a similar setup for publishing Rubygems using OIDC credentials:

https://github.com/buildkite-plugins/rubygems-oidc-buildkite-plugin

I will prepare an equivalent Buildkite plugin that could be used with this proposed support.

We would also be quite interested in supporting npm attestations. Buildkite is already supported by sigstore and fulcio, it just needs plumbing.

This code was prepared with @ampcode.

Amp-Thread-ID: https://ampcode.com/threads/T-01a012fc-30d4-70ed-9e1e-ce5a74dc5e1c

References

• feat: adds circleci to trust command #8909 introduced support for CircleCI
• feat: adds support for oidc publish #8336 originally introduced trusted publishing