feat: add GCP Application Default Credentials token strategy

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cloudsmith-iduffy

cloudsmith_cli/core/credentials/oidc/detectors/gcp.py

@@ -127,4 +127,15 @@ def _token_from_service_account_file(self, audience: str) -> str | None:
             return None
 
     def _token_from_adc(self, audience: str) -> str | None:
-        return None
+        try:
+            import google.auth  # pylint: disable=import-error
+            from google.auth.transport.requests import (  # pylint: disable=import-error
+                Request,
+            )
+
+            credentials, _ = google.auth.default()
+            credentials.refresh(Request())
+            return getattr(credentials, "id_token", None) or None
+        except Exception:  # pylint: disable=broad-exception-caught
+            logger.debug("GCPDetector: ADC id_token fetch failed", exc_info=True)
+            return None

cloudsmith_cli/core/tests/test_gcp_detector.py

@@ -138,3 +138,24 @@ def test_skipped_when_env_unset(self):
             get.side_effect = requests.exceptions.ConnectionError()
             with pytest.raises(ValueError):
                 make_detector().get_token()
+
+
+class TestGetTokenADC:
+    def test_returns_id_token_from_adc(self):
+        fake_creds = mock.Mock(id_token="adc-jwt")
+        with mock.patch(f"{GCP_MODULE}.requests.get") as get, mock.patch.dict(
+            "os.environ", {}, clear=True
+        ), mock.patch("google.auth.default", return_value=(fake_creds, "proj")):
+            get.side_effect = requests.exceptions.ConnectionError()
+            token = make_detector().get_token()
+        assert token == "adc-jwt"
+        fake_creds.refresh.assert_called_once()
+
+    def test_raises_when_adc_has_no_id_token(self):
+        fake_creds = mock.Mock(spec=["refresh"])  # no id_token attribute
+        with mock.patch(f"{GCP_MODULE}.requests.get") as get, mock.patch.dict(
+            "os.environ", {}, clear=True
+        ), mock.patch("google.auth.default", return_value=(fake_creds, "proj")):
+            get.side_effect = requests.exceptions.ConnectionError()
+            with pytest.raises(ValueError):
+                make_detector().get_token()