infra: prove out a CI run scrobbling as a didbot pipeline account, with no stored secret · Issue #134 · permadeath.com/vibescrobble.com

didbot can make a CI pipeline an agent account of its own, signed in by the CI's OIDC token. This is shipped on didbot main (plan/ownership.md:137, test crates/didbot/tests/scenarios/oidc.rs:45). This issue is a proof-out: one of our own CI jobs posts "release v0.x built" as its pipeline account.

didbot side (exists)

Setup, once: didbot operate ci.pds.did.bot <operator> --kind pipeline --oidc <issuer> repository_id=<id> (docs/pipelines.md:18, docs/cli.md:235-243).
Per run: mint an ID token with audience=did:web:<server>, then didbot oauth pending --token-file F --account ci.pds.did.bot. That calls bot.did.createSession (didbot-serve/src/tree/mod.rs:834, tree/oidc.rs:188). Every later didbot oauth in the job runs as the pipeline.

vibescrobble side

vibescrobble login already works on a runner. It binds a loopback port, prints the URL (crates/vibescrobble-cli/src/main.rs:410-466), and didbot oauth approve approves it as the pipeline.
No CLI change, no new credential: the CLI keeps its OAuth+DPoP Session (session.rs:85); the OIDC token stays didbot's.
The alternative is a bearer mode in the CLI that sends didbot's account token (main.rs:1372). That would be a new credential type for vibescrobble, which needs the owner's approval. Not proposed.
In CI, use post --wait or flush: post returns before publishing, and the job may exit first.

Minimal demo

Fresh ID token, then didbot oauth pending.
vibescrobble login --as ci.pds.did.bot.
Fresh token, then didbot oauth approve.
vibescrobble post --wait --text 'release v0.x built' --emoji '📦'.

No secret in the repo.

Blocker: where it runs

vibescrobble has no CI (3mwixdmc7tg2v). scripts/ci.sh exists, and nothing runs it.
didbot has .tangled/workflows/ci.yml, idle until a spindle is attached (DEVELOPING.md:55-75).
Neither has a GitHub mirror.
didbot's documented issuers are GitHub, GitLab, Google, Kubernetes, Azure and Cognito (docs/pipelines.md:109-116). Tangled spindle is not among them.

Decisions for the owner

Run it on a Tangled spindle (if spindles mint OIDC tokens; unconfirmed), a GitHub mirror with Actions, or a runner with workload identity?
Which repo's CI goes first?

didbot owns: spindle issuer support if chosen, and a test that a pipeline can oauth approve (only pending is covered, oidc.rs:87-108). vibescrobble owns: the workflow, and a docs/ page if it works.

Filed by Claude (agent) from a static read of both mains (vibescrobble fa848b5).