[yordis]

• Follow-up to Add Trusted Publishing hexpm#1785, so CI can publish without storing a long-lived Hex API key.

[ericmj]

Most of lib/hex/trusted_publisher.ex should move to hex_core so rebar3_hex can share it:

• exchange!/2 and Hex.API.OAuth.jwt_bearer_token/2 become hex_api_oauth:jwt_bearer_token(Config, Assertion, Scope), next to client_credentials_token.
• audience!/0 and lib/hex/api/oidc.ex become hex_api_oauth:oidc_audience/1 or a small hex_api_oidc module.
• github_oidc_request/0, put_audience/2 and github_oidc_token!/3 go in a new hex_core module that detects the CI provider and fetches its OIDC token through hex_http:request/5, so the request uses the build tool's HTTP adapter (proxy settings, CA certs) instead of calling Hex.HTTP directly.
• hex_core supports OTP 24+ and has no JSON decoder. decode_json/1 can use json:decode/1 when it's loaded and otherwise take value with a match limited to the JWT alphabet (base64url and .). A compact JWT can't contain quotes or JSON escapes, and a bad extraction fails hexpm's signature check. That removes the OTP 27 / Elixir 1.18 requirement for both mix and rebar3.
• configured_credentials?/0 can be deleted, since hex_cli_auth:resolve_api_auth/2 already knows whether credentials resolve. The entry point would be something like hex_cli_auth:trusted_publisher_auth(Config, Scope), returning {ok, <<"Bearer ", Token/binary>>}, none when credentials exist or no CI provider is detected, or {error, Reason}. Mix calls it once per publish and passes the key to both the release and docs requests, as publish_auth/3 does now. Doing it inside with_api would mint a token for each request.
• describe_error/1 and the Mix.raise messages stay in hex, and hex_core returns tagged errors such as {error, {oidc_token_request_failed, Status}}.

What stays in hex is the call site in hex.publish.ex (skip on --dry-run, run after the prompt and the docs build, print the info line), so lib/hex/trusted_publisher.ex and lib/hex/api/oidc.ex go away. The organization-level repository:<org> exchange planned in hexpm/hexpm#1785 (comment) needs the same CI token fetch from do_resolve_repo_auth in hex_cli_auth, next to exchange_for_oauth_token.

Once this ships, the GitHub Actions example in the hexpm trusted publishers docs should switch from the curl exchange and HEX_API_KEY="Bearer ..." to id-token: write plus mix hex.publish --yes, with the minimum Hex version.