adding circleci - followup discussion

[meeech]

Tested out in https://fulcio.sigstage.dev, things worked as expected (meeech#1)

Before we promote to prod, i just want to check something.

Based on this discussion (pypi/warehouse#13888 (comment)), I am pursuing putting our .well-known at the root of the oidc.circleci.com domain.

Is it better to just wait till that's done, and add that to the identity/config.yaml?
so we would be similar to github - they have https://token.actions.githubusercontent.com/* in metaissuers and https://token.actions.githubusercontent.com/ in oidc-issuers. So we would do the same.

[haydentherapper]

Would you still have per-organization OIDC providers in addition to the central hosted provider, like GitHub's setup? If so, I think it'd be fine to proceed with pushing this out to prod, since there would be no deprecation of the per-organization providers. If you are planning to only have the well-known configuration hosted at oidc.circleci.com, then I think holding off would make sense to avoid issuing certificates with a soon-to-be-deprecated provider URL.

[meeech]

Yes. everything existing will stay the same. No deprecation - so yes, like github setup. So cool let move it to prod.

Since pypi (and I think other package repos) will require a custom aud, and that can only be generated on demand via a cli tool in the job, i figure we will add another flag set making top level iss for the generated token, and write up a guide for people.

[haydentherapper]

This has now been rolled out to prod. Can you verify it's working as expected?