Skip to content

feat: add generic OIDC detector - #304

Merged
cloudsmith-iduffy merged 1 commit into
masterfrom
generic-oidc-detector
Jun 10, 2026
Merged

feat: add generic OIDC detector#304
cloudsmith-iduffy merged 1 commit into
masterfrom
generic-oidc-detector

Conversation

@cloudsmith-iduffy

Copy link
Copy Markdown
Contributor

What

Adds a generic fallback OIDC detector that reads an OIDC JWT from the CLOUDSMITH_OIDC_TOKEN environment variable.

This supports:

How

  • New GenericDetector in cloudsmith_cli/core/credentials/oidc/detectors/generic.py, following the same EnvironmentDetector pattern as the AWS detector.
  • detect() returns True when CLOUDSMITH_OIDC_TOKEN is set and non-empty; get_token() returns the value or raises ValueError with guidance if unset.
  • Registered last in _DETECTORS so vendor-specific detectors (AWS, etc.) take precedence — the generic detector is a catch-all fallback.
  • The token flows through the existing exchange path unchanged.

Naming note

The environment variable name CLOUDSMITH_OIDC_TOKEN was considered against alternatives (CLOUDSMITH_OIDC_ID_TOKEN, CLOUDSMITH_OIDC_JWT) since "TOKEN" could be misread as a directly-usable API token rather than a JWT to be exchanged. The shorter CLOUDSMITH_OIDC_TOKEN was chosen; the get_token() error message clarifies it is "the OIDC JWT to exchange for a Cloudsmith token."

Testing

  • Added cloudsmith_cli/core/tests/test_generic_detector.py (TDD — written first), mirroring the Bitbucket detector tests: detection (present / unset / empty) and token retrieval (returns / raises).
  • All new tests pass; related credential/detector suite (43 tests) passes.

🤖 Generated with Claude Code

CopilotAI review requested due to automatic review settings June 8, 2026 21:59
@cloudsmith-iduffy
cloudsmith-iduffy requested a review from a team as a code ownerJune 8, 2026 21:59

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a generic, env-var based OIDC detector so the CLI can exchange an injected OIDC JWT (e.g., from Jenkins or custom CI/CD) when no vendor-specific detector matches.

Changes:

  • Introduces GenericDetector that reads CLOUDSMITH_OIDC_TOKEN for OIDC token exchange.
  • Registers the generic detector after existing detectors so it acts as a fallback.
  • Adds unit tests covering presence/absence of the env var and token retrieval behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

FileDescription
cloudsmith_cli/core/credentials/oidc/detectors/generic.pyAdds a new fallback detector that sources an OIDC JWT from CLOUDSMITH_OIDC_TOKEN.
cloudsmith_cli/core/credentials/oidc/detectors/__init__.pyRegisters the new detector in the detector chain.
cloudsmith_cli/core/tests/test_generic_detector.pyAdds tests for generic detector detection and token retrieval behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment threadcloudsmith_cli/core/credentials/oidc/detectors/generic.py Outdated
Comment threadcloudsmith_cli/core/credentials/oidc/detectors/generic.py
Comment threadcloudsmith_cli/core/tests/test_generic_detector.py
Comment threadcloudsmith_cli/core/tests/test_generic_detector.py
Comment threadcloudsmith_cli/core/credentials/oidc/detectors/generic.py

@BartoszBlizniakBartoszBlizniak left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pre-apprv

Comment threadcloudsmith_cli/core/credentials/oidc/detectors/__init__.py
Add a generic fallback to OIDC credential auto-discovery. When no dedicated
environment is detected, the CLI reads an OIDC token from the
CLOUDSMITH_OIDC_TOKEN environment variable (useful for Jenkins or any custom
CI/CD) and exchanges it for a Cloudsmith access token. Whitespace-only values
are treated as unset, and the token is stripped before use. Registered last
so a dedicated environment is always preferred when present.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@cloudsmith-iduffy
cloudsmith-iduffy merged commit fc648d2 into masterJun 10, 2026
40 checks passed
@cloudsmith-iduffy
cloudsmith-iduffy deleted the generic-oidc-detector branch June 10, 2026 16:39
cloudsmith-iduffy added a commit that referenced this pull request Jun 10, 2026
* origin/master:
feat: add generic OIDC detector (#304)
# Conflicts:
#	cloudsmith_cli/core/credentials/oidc/detectors/__init__.py
cloudsmith-iduffy added a commit that referenced this pull request Jun 10, 2026
…r-controls
* origin/master:
feat: add generic OIDC detector (#304)
# Conflicts:
#	CHANGELOG.md
#	README.md
#	cloudsmith_cli/core/credentials/oidc/detectors/__init__.py
#	cloudsmith_cli/core/credentials/oidc/detectors/generic.py
cloudsmith-iduffy added a commit that referenced this pull request Jun 10, 2026
* origin/master:
feat: add generic OIDC detector (#304)
# Conflicts:
#	cloudsmith_cli/core/credentials/oidc/detectors/__init__.py
@BartoszBlizniakBartoszBlizniak mentioned this pull request Jun 11, 2026
6 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@cloudsmith-iduffy@BartoszBlizniak