feat: add Google Cloud OIDC detector

cloudsmith-iduffy · claude · cloudsmith-iduffy · commit 22639e1c2960 · 2026-06-10T14:50:45.000+01:00
Adds a Google Cloud OIDC environment detector to the credential
auto-discovery chain, mirroring the existing AWS detector. When
CLOUDSMITH_ORG and CLOUDSMITH_SERVICE_SLUG are set, the CLI mints an
OIDC ID token from the ambient Google identity via the google-auth SDK
and exchanges it for a short-lived Cloudsmith token.

Discovery uses google.auth.default() -- the standard ADC chain
(GOOGLE_APPLICATION_CREDENTIALS service-account key, local gcloud user
credentials, then the GCE/Cloud Run/GKE/App Engine metadata server).
get_token() turns the resolved credentials into an ID token:

- compute/metadata credentials are queried via the metadata client with
  format=full, which adds the email/identity claims so users have more
  to validate against (the SDK's metadata ID-token path omits them);
- local gcloud user credentials use their refreshed id_token directly
  (fetch_id_token_credentials does not support user credentials);
- service-account keys, impersonated service accounts, and external
  accounts / Workload Identity Federation are delegated to google-auth's
  own fetch_id_token_credentials dispatch.

detect() activates only when google-auth is importable and either ADC
resolves or the metadata server is reachable (via the IP-based
is_on_gce probe, avoiding slow DNS on non-GCE hosts); it never raises
into the chain. google-auth is an optional dependency under a new [gcp]
extra.

Co-Authored-By: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 - Added Azure DevOps to OIDC credential auto-discovery. When running in an Azure DevOps pipeline, the CLI fetches an OIDC token from the `SYSTEM_OIDCREQUESTURI` endpoint using the pipeline's `SYSTEM_ACCESSTOKEN` and exchanges it for a Cloudsmith access token. Works out of the box with no extra dependencies.
 - Added GitHub Actions to OIDC credential auto-discovery. When running in GitHub Actions (with `id-token: write` permission), the CLI fetches an OIDC token from the Actions runtime endpoint and exchanges it for a Cloudsmith access token. Works out of the box with no extra dependencies.
+- Added Google Cloud (GCP) support to OIDC credential auto-discovery. Install with the `gcp` extra (`pip install cloudsmith-cli[gcp]`) to authenticate using the ambient Google Cloud identity: the attached service account on GCE/Cloud Run/GKE/Cloud Functions/App Engine/Cloud Build, a `GOOGLE_APPLICATION_CREDENTIALS` service-account key, or a local `gcloud auth application-default login` session. The CLI discovers credentials via the `google-auth` SDK's Application Default Credentials chain, mints a short-lived OIDC ID token, and exchanges it for a Cloudsmith access token. Without the extra installed, the detector skips itself with no errors.
 
 ## [1.18.0] - 2026-06-09
 
@@ -28,7 +29,6 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 - `metadata list` filters (`--source-kind`, `--classification`) now send the enum name the v2 API expects instead of an integer, fixing an HTTP 400 on every filtered list. Valid source kinds: `unknown, system, upstream, custom, third_party`; classifications: `unknown, intrinsic, security, provenance, sbom, generic`.
 
-
 ## [1.17.0] - 2026-05-18
 
 ### Added
diff --git a/README.md b/README.md
@@ -155,6 +155,16 @@ pip install cloudsmith-cli[aws]
 
 This installs `boto3[crt]` for AWS credential chain support, STS token generation, and AWS SSO compatibility.
 
+#### GCP OIDC Support
+
+For Google Cloud environments (GCE, Cloud Run, GKE, Cloud Functions, App Engine, Cloud Build), install with the `gcp` extra to enable automatic credential discovery:
+
+```
+pip install cloudsmith-cli[gcp]
+```
+
+This installs `google-auth` for Application Default Credentials resolution and OIDC ID token generation. It works with the attached service account on Google Cloud workloads, a `GOOGLE_APPLICATION_CREDENTIALS` service-account key, or a local `gcloud auth application-default login` session. See Google's [Authenticate with auth libraries](https://docs.cloud.google.com/iam/docs/authenticate-with-auth-libraries#authenticate-standard) guide for how credentials are resolved.
+
 #### All Optional Features
 
 To install all optional dependencies:
diff --git a/cloudsmith_cli/core/credentials/oidc/detectors/__init__.py b/cloudsmith_cli/core/credentials/oidc/detectors/__init__.py
@@ -8,6 +8,7 @@
 from .aws import AWSDetector
 from .azure_devops import AzureDevOpsDetector
 from .base import EnvironmentDetector
+from .gcp import GCPDetector
 from .github_actions import GitHubActionsDetector
 
 if TYPE_CHECKING:
@@ -19,6 +20,7 @@
     AzureDevOpsDetector,
     GitHubActionsDetector,
     AWSDetector,
+    GCPDetector,
 ]
 
 
diff --git a/cloudsmith_cli/core/credentials/oidc/detectors/gcp.py b/cloudsmith_cli/core/credentials/oidc/detectors/gcp.py
@@ -0,0 +1,132 @@
+"""Google Cloud OIDC detector.
+
+Discovers the ambient Google identity via google-auth's Application Default
+Credentials chain and mints an OIDC ID token for Cloudsmith.
+
+Requires google-auth (optional dependency): pip install cloudsmith-cli[gcp]
+
+References:
+    https://docs.cloud.google.com/iam/docs/authenticate-with-auth-libraries#authenticate-standard
+    https://googleapis.dev/python/google-auth/latest/index.html
+    https://googleapis.dev/python/google-auth/latest/user-guide.html
+    https://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth
+"""
+
+# google-auth is an optional dependency; its imports are unavailable at lint time.
+# pylint: disable=import-error
+
+from __future__ import annotations
+
+import logging
+
+from .base import EnvironmentDetector
+
+logger = logging.getLogger(__name__)
+
+DEFAULT_AUDIENCE = "cloudsmith"
+
+METADATA_IDENTITY_PATH = "instance/service-accounts/default/identity"
+
+
+class GCPDetector(EnvironmentDetector):
+    """Detects Google Cloud environments and obtains an OIDC ID token."""
+
+    name = "Google Cloud"
+
+    def detect(self) -> bool:
+        try:
+            import google.auth
+            from google.auth import exceptions
+        except ImportError:
+            logger.debug("GCPDetector: google-auth not installed, skipping")
+            return False
+
+        try:
+            google.auth.default()
+            return True
+        except exceptions.DefaultCredentialsError:
+            return self._on_gce()
+        except exceptions.GoogleAuthError:
+            logger.debug("GCPDetector: error during detection", exc_info=True)
+            return False
+
+    def get_token(self) -> str:
+        audience = self.context.oidc_audience or DEFAULT_AUDIENCE
+
+        import google.auth
+        from google.auth import compute_engine, exceptions
+        from google.auth.transport.requests import Request
+        from google.oauth2 import credentials as user_creds
+
+        request = Request()
+        try:
+            credentials, _ = google.auth.default()
+        except exceptions.DefaultCredentialsError:
+            token = self._token_from_metadata(audience)
+        else:
+            if isinstance(credentials, compute_engine.Credentials):
+                token = self._token_from_metadata(audience)
+            elif isinstance(credentials, user_creds.Credentials):
+                token = self._token_from_user_credentials(credentials, request)
+            else:
+                token = self._token_from_id_token_credentials(audience, request)
+
+        if not token:
+            raise ValueError(
+                "Google Cloud detector resolved Google credentials but could "
+                "not mint an OIDC ID token. Set CLOUDSMITH_OIDC_TOKEN to "
+                "provide a token directly."
+            )
+        return token
+
+    def _on_gce(self) -> bool:
+        from google.auth import exceptions
+        from google.auth.compute_engine import _metadata
+        from google.auth.transport.requests import Request
+
+        try:
+            return bool(_metadata.is_on_gce(Request()))
+        except exceptions.GoogleAuthError:
+            return False
+
+    def _token_from_metadata(self, audience: str) -> str | None:
+        from google.auth import exceptions
+        from google.auth.compute_engine import _metadata
+        from google.auth.transport.requests import Request
+
+        try:
+            token = _metadata.get(
+                Request(),
+                METADATA_IDENTITY_PATH,
+                params={"audience": audience, "format": "full"},
+            )
+        except exceptions.GoogleAuthError:
+            logger.debug("GCPDetector: metadata id token fetch failed", exc_info=True)
+            return None
+        if not isinstance(token, str):
+            return None
+        return token.strip() or None
+
+    def _token_from_user_credentials(self, credentials, request) -> str | None:
+        from google.auth import exceptions
+
+        try:
+            credentials.refresh(request)
+        except exceptions.GoogleAuthError:
+            logger.debug("GCPDetector: ADC id_token refresh failed", exc_info=True)
+            return None
+        return getattr(credentials, "id_token", None) or None
+
+    def _token_from_id_token_credentials(self, audience: str, request) -> str | None:
+        from google.auth import exceptions
+        from google.oauth2 import id_token
+
+        try:
+            id_credentials = id_token.fetch_id_token_credentials(audience, request)
+            id_credentials.refresh(request)
+            return id_credentials.token or None
+        except exceptions.GoogleAuthError:
+            logger.debug(
+                "GCPDetector: ID token credentials fetch failed", exc_info=True
+            )
+            return None
diff --git a/cloudsmith_cli/core/tests/test_gcp_detector.py b/cloudsmith_cli/core/tests/test_gcp_detector.py
@@ -0,0 +1,156 @@
+"""Tests for the Google Cloud OIDC detector."""
+
+import sys
+from unittest import mock
+
+import pytest
+
+from cloudsmith_cli.core.credentials.models import CredentialContext
+from cloudsmith_cli.core.credentials.oidc.detectors.gcp import GCPDetector
+
+compute_engine = pytest.importorskip("google.auth.compute_engine")
+exceptions = pytest.importorskip("google.auth.exceptions")
+oauth2_creds = pytest.importorskip("google.oauth2.credentials")
+
+METADATA_GET = "google.auth.compute_engine._metadata.get"
+METADATA_IS_ON_GCE = "google.auth.compute_engine._metadata.is_on_gce"
+FETCH_ID_TOKEN_CREDS = "google.oauth2.id_token.fetch_id_token_credentials"
+
+
+def make_detector(**ctx):
+    return GCPDetector(context=CredentialContext(**ctx))
+
+
+class TestDetect:
+    def test_not_detected_when_google_auth_missing(self):
+        with mock.patch.dict(sys.modules, {"google.auth": None}):
+            assert make_detector().detect() is False
+
+    def test_detected_when_adc_resolves(self):
+        with mock.patch("google.auth.default", return_value=(mock.MagicMock(), "proj")):
+            assert make_detector().detect() is True
+
+    def test_detected_via_metadata_when_adc_unavailable(self):
+        with mock.patch(
+            "google.auth.default",
+            side_effect=exceptions.DefaultCredentialsError("no adc"),
+        ), mock.patch(METADATA_IS_ON_GCE, return_value=True):
+            assert make_detector().detect() is True
+
+    def test_not_detected_when_nothing_available(self):
+        with mock.patch(
+            "google.auth.default",
+            side_effect=exceptions.DefaultCredentialsError("no adc"),
+        ), mock.patch(METADATA_IS_ON_GCE, return_value=False):
+            assert make_detector().detect() is False
+
+    def test_not_detected_on_google_auth_error(self):
+        with mock.patch(
+            "google.auth.default", side_effect=exceptions.GoogleAuthError("boom")
+        ):
+            assert make_detector().detect() is False
+
+
+class TestGetTokenMetadata:
+    def test_compute_credentials_use_metadata_with_format_full(self):
+        compute_creds = mock.Mock(spec=compute_engine.Credentials)
+        with mock.patch(
+            "google.auth.default", return_value=(compute_creds, "proj")
+        ), mock.patch(METADATA_GET, return_value="meta-jwt\n") as get:
+            token = make_detector().get_token()
+        assert token == "meta-jwt"
+        args, kwargs = get.call_args
+        assert args[1] == "instance/service-accounts/default/identity"
+        assert kwargs["params"] == {"audience": "cloudsmith", "format": "full"}
+
+    def test_uses_configured_audience(self):
+        compute_creds = mock.Mock(spec=compute_engine.Credentials)
+        with mock.patch(
+            "google.auth.default", return_value=(compute_creds, "proj")
+        ), mock.patch(METADATA_GET, return_value="meta-jwt") as get:
+            make_detector(oidc_audience="custom-aud").get_token()
+        _, kwargs = get.call_args
+        assert kwargs["params"]["audience"] == "custom-aud"
+
+    def test_falls_back_to_metadata_when_default_raises(self):
+        with mock.patch(
+            "google.auth.default",
+            side_effect=exceptions.DefaultCredentialsError("no adc"),
+        ), mock.patch(METADATA_GET, return_value="meta-jwt"):
+            assert make_detector().get_token() == "meta-jwt"
+
+    def test_raises_when_metadata_returns_blank(self):
+        compute_creds = mock.Mock(spec=compute_engine.Credentials)
+        with mock.patch(
+            "google.auth.default", return_value=(compute_creds, "proj")
+        ), mock.patch(METADATA_GET, return_value="   "):
+            with pytest.raises(ValueError):
+                make_detector().get_token()
+
+    def test_raises_when_metadata_errors(self):
+        compute_creds = mock.Mock(spec=compute_engine.Credentials)
+        with mock.patch(
+            "google.auth.default", return_value=(compute_creds, "proj")
+        ), mock.patch(METADATA_GET, side_effect=exceptions.TransportError("boom")):
+            with pytest.raises(ValueError):
+                make_detector().get_token()
+
+
+class TestGetTokenUserCredentials:
+    def test_returns_refreshed_id_token(self):
+        user_creds = mock.Mock(spec=oauth2_creds.Credentials)
+        user_creds.id_token = "adc-jwt"
+        with mock.patch("google.auth.default", return_value=(user_creds, "proj")):
+            token = make_detector().get_token()
+        assert token == "adc-jwt"
+        user_creds.refresh.assert_called_once()
+
+    def test_raises_when_user_credentials_have_no_id_token(self):
+        user_creds = mock.Mock(spec=oauth2_creds.Credentials)
+        user_creds.id_token = None
+        with mock.patch("google.auth.default", return_value=(user_creds, "proj")):
+            with pytest.raises(ValueError):
+                make_detector().get_token()
+
+
+class TestGetTokenIdTokenCredentials:
+    def test_delegates_to_fetch_id_token_credentials(self):
+        # A non-compute, non-user credential (e.g. service-account key or
+        # Workload Identity Federation) is delegated to google-auth's dispatch.
+        other_creds = mock.Mock()
+        id_creds = mock.Mock(token="sa-jwt")
+        with mock.patch(
+            "google.auth.default", return_value=(other_creds, "proj")
+        ), mock.patch(FETCH_ID_TOKEN_CREDS, return_value=id_creds) as fetch:
+            token = make_detector(oidc_audience="aud").get_token()
+        assert token == "sa-jwt"
+        args, _ = fetch.call_args
+        assert args[0] == "aud"
+        id_creds.refresh.assert_called_once()
+
+    def test_raises_when_dispatch_fails(self):
+        other_creds = mock.Mock()
+        with mock.patch(
+            "google.auth.default", return_value=(other_creds, "proj")
+        ), mock.patch(
+            FETCH_ID_TOKEN_CREDS, side_effect=exceptions.DefaultCredentialsError("x")
+        ):
+            with pytest.raises(ValueError):
+                make_detector().get_token()
+
+
+class TestRegistration:
+    def test_registered_after_aws(self):
+        from cloudsmith_cli.core.credentials.oidc.detectors import (
+            _DETECTORS,
+            AWSDetector,
+            AzureDevOpsDetector,
+            GitHubActionsDetector,
+        )
+
+        assert _DETECTORS == [
+            AzureDevOpsDetector,
+            GitHubActionsDetector,
+            AWSDetector,
+            GCPDetector,
+        ]
diff --git a/setup.py b/setup.py
@@ -69,8 +69,12 @@ def get_long_description():
         "aws": [
             "boto3[crt]>=1.26.0",
         ],
+        "gcp": [
+            "google-auth>=2.0.0",
+        ],
         "all": [
             "boto3[crt]>=1.26.0",
+            "google-auth>=2.0.0",
         ],
     },
     entry_points={
