feat: add OIDC detector enable/order controls

[cloudsmith-iduffy]

What

Adds controls for OIDC detector selection to the credential auto-discovery chain, so a detector that matches an environment you don't want it to (for example, the AWS detector matching ambient instance credentials) can be disabled or reordered.

Controls

Both controls are resolved through the credential context — the same plumbing as the other --oidc-* options — so detect_environment() reads only from the context, never directly from the environment.

• Disable a detector — CLOUDSMITH_OIDC_<ID>_DISABLED=true skips it. Only the literal string true (case-insensitive) disables; anything else leaves it enabled. The credentials decorator resolves these into context.oidc_disabled_detectors.
• Reorder evaluation — --oidc-detector-order (or the CLOUDSMITH_OIDC_DETECTOR_ORDER env var) takes a comma-separated list of detector ids and overrides both which detectors are considered and the order they are tried in (first match wins). Ids not listed are skipped; unknown ids are logged at debug and ignored.

Precedence: the order list defines the candidate set and sequence, then the disabled set is applied on top — a disabled detector is always skipped even if it appears in the order list. With neither set, behaviour is identical to today's fixed priority order.

Detector ids: aws, azure_devops, bitbucket, circleci, generic, github, gitlab.

How

• Each detector class gains a stable id attribute; the EnvironmentDetector base gets id = "base".
• detect_environment() selects via _ordered_detectors(order) + _enabled_detectors(order, disabled); a public registered_detectors() accessor is added; disabled_detectors_from_env() resolves the per-detector disable env vars.
• New CredentialContext fields oidc_detector_order and oidc_disabled_detectors, wired through decorators.py (the --oidc-detector-order option) and config.py, following the existing OIDC-option chain.
• README + CHANGELOG document both controls and the precedence rule.

Testing

• New cloudsmith_cli/core/tests/test_detector_controls.py (TDD): default order, per-detector disable (via context), env-var truthiness (true only), env resolution + var naming, order reordering, order limiting the candidate set, unknown-id-ignored, empty-order fallback, order+disable composition, and a registry id-uniqueness guard.
• Full relevant suite green; black/flake8/isort/pyupgrade/pylint (10/10)/typos all pass.

Note for reviewers

Google Cloud (gcp) is not part of this PR — it isn't in master yet. #306 layers the GCP detector (and its id = "gcp") on top of this branch and is targeted at it.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Integrates multiple new OIDC environment detectors (Bitbucket Pipelines, CircleCI, GitLab CI, GCP, and a generic fallback) into the CLI’s OIDC credential auto-discovery chain, and adds environment-variable controls to disable and/or reorder detector evaluation.

Changes:

• Added new OIDC detectors (Bitbucket, CircleCI, GitLab, GCP) plus a generic fallback, each with stable slugs.
• Implemented detector selection controls via CLOUDSMITH_OIDC_<SLUG>_DISABLED=true and CLOUDSMITH_OIDC_DETECTOR_ORDER=....
• Updated docs/packaging/CI to support the new detectors and optional gcp dependency, and added unit tests for detectors + control logic.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
setup.py	Adds google-auth under the gcp and all extras.
README.md	Documents GCP support, new detectors, and detector control env vars.
CHANGELOG.md	Records the new detectors and detector-control functionality under Unreleased.
.github/workflows/test.yml	Installs the editable package with the gcp extra so GCP tests run in CI.
cloudsmith_cli/core/credentials/oidc/detectors/base.py	Introduces shared DEFAULT_AUDIENCE and adds a base slug.
cloudsmith_cli/core/credentials/oidc/detectors/init.py	Registers new detectors and adds ordering/disable controls + registry accessor.
cloudsmith_cli/core/credentials/oidc/detectors/aws.py	Moves DEFAULT_AUDIENCE import to base and adds slug.
cloudsmith_cli/core/credentials/oidc/detectors/azure_devops.py	Adds slug to the detector.
cloudsmith_cli/core/credentials/oidc/detectors/github_actions.py	Moves DEFAULT_AUDIENCE import to base and adds slug.
cloudsmith_cli/core/credentials/oidc/detectors/bitbucket_pipelines.py	New Bitbucket Pipelines detector implementation.
cloudsmith_cli/core/credentials/oidc/detectors/circleci.py	New CircleCI detector implementation.
cloudsmith_cli/core/credentials/oidc/detectors/gitlab_ci.py	New GitLab CI detector implementation.
cloudsmith_cli/core/credentials/oidc/detectors/gcp.py	New Google Cloud detector implementation backed by google-auth.
cloudsmith_cli/core/credentials/oidc/detectors/generic.py	New generic env-var detector implementation for CLOUDSMITH_OIDC_TOKEN.
cloudsmith_cli/core/tests/test_bitbucket_pipelines_detector.py	Unit tests for Bitbucket detector + integration selection.
cloudsmith_cli/core/tests/test_circleci_detector.py	Unit tests for CircleCI detector + integration selection.
cloudsmith_cli/core/tests/test_gitlab_ci_detector.py	Unit tests for GitLab detector + integration selection.
cloudsmith_cli/core/tests/test_generic_detector.py	Unit tests for generic detector + integration selection.
cloudsmith_cli/core/tests/test_gcp_detector.py	Unit tests for GCP detector behavior and registration ordering.
cloudsmith_cli/core/tests/test_detector_controls.py	Unit tests for disable/order controls and slug uniqueness.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[BartoszBlizniak]

Few comments there but overall happy to merge in 👍