Uh oh!
There was an error while loading. Please reload this page.
feat: add Google Cloud OIDC detector - #306
Draft
cloudsmith-iduffy wants to merge 2 commits into
Draft
Conversation
cloudsmith-iduffy
marked this pull request as draft
June 8, 2026 22:57
cloudsmith-iduffyforce-pushed
the
iduffy/gcp-oidc
branch
from
June 8, 2026 23:01
e894eff to
c80922fComparecloudsmith-iduffyforce-pushed
the
iduffy/gcp-oidc
branch
6 times, most recently
from
June 10, 2026 14:06
e8c47d0 to
d8816e1Comparecloudsmith-iduffyforce-pushed
the
iduffy/gcp-oidc
branch
2 times, most recently
from
June 10, 2026 19:46
8c48230 to
60f4060CompareAdd two controls for OIDC detector selection, resolved through the credential context rather than read ad hoc from the environment: - CLOUDSMITH_OIDC_<ID>_DISABLED skips a specific detector (only the literal "true", case-insensitive, disables). The credentials decorator resolves these into context.oidc_disabled_detectors. - --oidc-detector-order (env var CLOUDSMITH_OIDC_DETECTOR_ORDER) overrides which detectors are considered and the order they are tried in (comma-separated ids; unlisted/unknown ids are skipped). When both are set the order list defines the candidate set and sequence, then the disabled set is applied on top, so a disabled detector is always skipped. Each detector gains a stable `id` attribute and a public `registered_detectors()` accessor is added. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds a Google Cloud OIDC environment detector to the credential auto-discovery chain, mirroring the existing AWS detector. When CLOUDSMITH_ORG and CLOUDSMITH_SERVICE_SLUG are set, the CLI mints an OIDC ID token from the ambient Google identity via the google-auth SDK and exchanges it for a short-lived Cloudsmith token. Discovery uses google.auth.default() -- the standard ADC chain (GOOGLE_APPLICATION_CREDENTIALS service-account key, local gcloud user credentials, then the GCE/Cloud Run/GKE/App Engine metadata server). get_token() turns the resolved credentials into an ID token: - compute/metadata credentials are queried via the metadata client with format=full, which adds the email/identity claims so users have more to validate against (the SDK's metadata ID-token path omits them); - local gcloud user credentials use their refreshed id_token directly (fetch_id_token_credentials does not support user credentials); - service-account keys, impersonated service accounts, and external accounts / Workload Identity Federation are delegated to google-auth's own fetch_id_token_credentials dispatch. detect() activates only when google-auth is importable and either ADC resolves or the metadata server is reachable (via the IP-based is_on_gce probe, avoiding slow DNS on non-GCE hosts); it never raises into the chain. google-auth is an optional dependency under a new [gcp] extra. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
cloudsmith-iduffyforce-pushed
the
iduffy/gcp-oidc
branch
from
June 10, 2026 20:26
60f4060 to
ceeb715Comparecloudsmith-iduffy
changed the base branch from
master
to
iduffy/oidc-detector-controlsJune 10, 2026 20:26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a Google Cloud OIDC environment detector to the credential auto-discovery chain, mirroring the existing AWS detector. When
CLOUDSMITH_ORGandCLOUDSMITH_SERVICE_SLUGare set, the CLI mints an OIDC ID token from the ambient Google identity via thegoogle-authSDK and exchanges it for a short-lived Cloudsmith token — no long-lived credentials on disk.google-auth>=2.0.0under a[gcp]extra (also added to[all]), matching the AWS[aws]/boto3 pattern.google.auth.default()— the standard ADC chain (GOOGLE_APPLICATION_CREDENTIALSservice-account key → local gcloud user credentials → GCE/Cloud Run/GKE/App Engine metadata server).get_token()turns the resolved credentials into an ID token:format=full, which adds theemail/identity claims so users have more to validate against (the SDK's metadata ID-token path omits them).id_tokenused directly (fetch_id_token_credentialsdoesn't support user credentials).fetch_id_token_credentialsdispatch.detect()activates only whengoogle-authis importable and either ADC resolves or the metadata server is reachable (via the IP-basedis_on_gceprobe, which avoids the slow-DNS hang on non-GCE hosts); it never raises into the chain.[AWSDetector, GCPDetector]— after the AWS detector.Test Plan
test_gcp_detector.pycovering all detect branches and every credential path (compute/metadata, user ADC, delegated dispatch, fallbacks); hermetic (real ADC on the dev machine is never touched). Skipped cleanly when the[gcp]extra is absent. Full core suite: 171 passed, no regressions.CLOUDSMITH_ORG=iduffy-demo CLOUDSMITH_SERVICE_SLUG=google-10rf cloudsmith whoamiauthenticates as thegoogle-10rfservice account via the user-ADC path in ~3s (no hang).🤖 Generated with Claude Code