Merge remote-tracking branch 'origin/iduffy/gcp-oidc' into iduffy/oidc-detector-controls

* origin/iduffy/gcp-oidc:
  refactor: apply code review fixes to GCP OIDC detector
  fix: mint OIDC token via IAM Credentials on Cloud Build
  feat: add Google Cloud OIDC detector

# Conflicts:
#	CHANGELOG.md
#	cloudsmith_cli/core/credentials/oidc/detectors/__init__.py

Author: cloudsmith-iduffy

.github/workflows/test.yml

@@ -39,7 +39,7 @@ jobs:
           pip install -r requirements.txt
 
       - name: Install package
-        run: pip install -e .
+        run: pip install -e ".[gcp]"
 
       - name: Run pytest
         env:

CHANGELOG.md

@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Added Azure DevOps to OIDC credential auto-discovery. When running in an Azure DevOps pipeline, the CLI fetches an OIDC token from the `SYSTEM_OIDCREQUESTURI` endpoint using the pipeline's `SYSTEM_ACCESSTOKEN` and exchanges it for a Cloudsmith access token. Works out of the box with no extra dependencies.
 - Added GitHub Actions to OIDC credential auto-discovery. When running in GitHub Actions (with `id-token: write` permission), the CLI fetches an OIDC token from the Actions runtime endpoint and exchanges it for a Cloudsmith access token. Works out of the box with no extra dependencies.
 - Added GitLab CI to OIDC credential auto-discovery. When running in GitLab CI/CD, the CLI reads the OIDC token from the `CLOUDSMITH_OIDC_TOKEN` environment variable (configured via `id_tokens` in `.gitlab-ci.yml`, with legacy fallbacks to `CI_JOB_JWT_V2` / `CI_JOB_JWT`) and exchanges it for a Cloudsmith access token. Works out of the box with no extra dependencies.
+- Added Google Cloud (GCP) support to OIDC credential auto-discovery. Install with the `gcp` extra (`pip install cloudsmith-cli[gcp]`) to authenticate using the ambient Google Cloud identity: the attached service account on GCE/Cloud Run/GKE/Cloud Functions/App Engine/Cloud Build, a `GOOGLE_APPLICATION_CREDENTIALS` service-account key, or a local `gcloud auth application-default login` session. The CLI discovers credentials via the `google-auth` SDK's Application Default Credentials chain, mints a short-lived OIDC ID token, and exchanges it for a Cloudsmith access token. On Cloud Build, where the metadata server exposes no ID-token endpoint, the token is minted via the IAM Credentials API (`generateIdToken`), which requires the build service account to hold `roles/iam.serviceAccountTokenCreator` on itself. Without the extra installed, the detector skips itself with no errors.
 - Added a generic fallback to OIDC credential auto-discovery. When no dedicated environment is detected, the CLI reads an OIDC token from the `CLOUDSMITH_OIDC_TOKEN` environment variable (useful for Jenkins or any custom CI/CD) and exchanges it for a Cloudsmith access token. Works out of the box with no extra dependencies.
 
 ## [1.18.0] - 2026-06-09

README.md

@@ -155,6 +155,24 @@ pip install cloudsmith-cli[aws]
 
 This installs `boto3[crt]` for AWS credential chain support, STS token generation, and AWS SSO compatibility.
 
+#### GCP OIDC Support
+
+For Google Cloud environments (GCE, Cloud Run, GKE, Cloud Functions, App Engine, Cloud Build), install with the `gcp` extra to enable automatic credential discovery:
+
+```
+pip install cloudsmith-cli[gcp]
+```
+
+This installs `google-auth` for Application Default Credentials resolution and OIDC ID token generation. It works with the attached service account on Google Cloud workloads, a `GOOGLE_APPLICATION_CREDENTIALS` service-account key, or a local `gcloud auth application-default login` session. See Google's [Authenticate with auth libraries](https://docs.cloud.google.com/iam/docs/authenticate-with-auth-libraries#authenticate-standard) guide for how credentials are resolved.
+
+On **Cloud Build** the metadata server does not expose an ID-token endpoint, so the CLI mints the token via the IAM Credentials API instead. This requires the build's runtime service account to be able to create tokens for itself — grant it `roles/iam.serviceAccountTokenCreator` on itself:
+
+```
+gcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT_EMAIL \
+  --member="serviceAccount:SERVICE_ACCOUNT_EMAIL" \
+  --role="roles/iam.serviceAccountTokenCreator"
+```
+
 #### All Optional Features
 
 To install all optional dependencies:
@@ -163,7 +181,7 @@ To install all optional dependencies:
 pip install cloudsmith-cli[all]
 ```
 
-**Note:** If you don't install the AWS extra, the AWS OIDC detector will gracefully skip itself with no errors.
+**Note:** If you don't install the AWS or GCP extras, the corresponding OIDC detectors will gracefully skip themselves with no errors.
 
 #### Bitbucket Pipelines OIDC Support
 

cloudsmith_cli/core/credentials/oidc/detectors/__init__.py

@@ -10,6 +10,7 @@
 from .base import EnvironmentDetector
 from .bitbucket_pipelines import BitbucketPipelinesDetector
 from .circleci import CircleCIDetector
+from .gcp import GCPDetector
 from .generic import GenericDetector
 from .github_actions import GitHubActionsDetector
 from .gitlab_ci import GitLabCIDetector
@@ -26,6 +27,7 @@
     GitHubActionsDetector,
     GitLabCIDetector,
     AWSDetector,
+    GCPDetector,
     GenericDetector,
 ]
 

cloudsmith_cli/core/credentials/oidc/detectors/aws.py

@@ -13,12 +13,10 @@
 
 import logging
 
-from .base import EnvironmentDetector
+from .base import DEFAULT_AUDIENCE, EnvironmentDetector
 
 logger = logging.getLogger(__name__)
 
-DEFAULT_AUDIENCE = "cloudsmith"
-
 
 class AWSDetector(EnvironmentDetector):
     """Detects AWS environments and obtains a JWT via STS GetWebIdentityToken."""

cloudsmith_cli/core/credentials/oidc/detectors/base.py

@@ -7,6 +7,8 @@
 if TYPE_CHECKING:
     from ... import CredentialContext
 
+DEFAULT_AUDIENCE = "cloudsmith"
+
 
 class EnvironmentDetector:
     """Base class for OIDC environment detectors."""

cloudsmith_cli/core/credentials/oidc/detectors/gcp.py

@@ -0,0 +1,178 @@
+# Copyright 2026 Cloudsmith Ltd
+"""Google Cloud OIDC detector.
+
+Discovers the ambient Google identity via google-auth's Application Default
+Credentials chain and mints an OIDC ID token for Cloudsmith.
+
+Requires google-auth (optional dependency): pip install cloudsmith-cli[gcp]
+
+References:
+    https://docs.cloud.google.com/iam/docs/authenticate-with-auth-libraries#authenticate-standard
+    https://googleapis.dev/python/google-auth/latest/index.html
+    https://googleapis.dev/python/google-auth/latest/user-guide.html
+    https://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth
+"""
+
+from __future__ import annotations
+
+import logging
+
+from .base import DEFAULT_AUDIENCE, EnvironmentDetector
+
+logger = logging.getLogger(__name__)
+
+METADATA_IDENTITY_PATH = "instance/service-accounts/default/identity"
+
+
+class GCPDetector(EnvironmentDetector):
+    """Detects Google Cloud environments and obtains an OIDC ID token."""
+
+    name = "Google Cloud"
+
+    def __init__(self, context):
+        super().__init__(context)
+        self._credentials = None
+
+    def detect(self) -> bool:
+        try:
+            import google.auth
+            from google.auth import exceptions
+        except ImportError:
+            logger.debug("GCPDetector: google-auth not installed, skipping")
+            return False
+
+        try:
+            self._credentials, _ = google.auth.default()
+            return True
+        except exceptions.DefaultCredentialsError:
+            return self._on_gce()
+        except exceptions.GoogleAuthError:
+            logger.debug("GCPDetector: error during detection", exc_info=True)
+            return False
+
+    def get_token(self) -> str:
+        audience = self.context.oidc_audience or DEFAULT_AUDIENCE
+
+        import google.auth  # pylint: disable=import-error
+        from google.auth import (  # pylint: disable=import-error
+            compute_engine,
+            exceptions,
+        )
+        from google.auth.transport.requests import (  # pylint: disable=import-error
+            Request,
+        )
+        from google.oauth2 import (  # pylint: disable=import-error
+            credentials as user_creds,
+        )
+
+        request = Request()
+        credentials = self._credentials
+        if credentials is None:
+            try:
+                credentials, _ = google.auth.default()
+            except exceptions.DefaultCredentialsError:
+                credentials = None
+
+        if credentials is None:
+            token = self._token_from_metadata(audience, request)
+        elif isinstance(credentials, compute_engine.Credentials):
+            token = self._token_from_metadata(audience, request)
+            if not token:
+                token = self._token_from_compute_id_token_credentials(audience, request)
+        elif isinstance(credentials, user_creds.Credentials):
+            if self.context.oidc_audience:
+                logger.debug(
+                    "GCPDetector: user credentials cannot mint a token for a "
+                    "custom audience; the configured oidc_audience is ignored"
+                )
+            token = self._token_from_user_credentials(credentials, request)
+        else:
+            token = self._token_from_id_token_credentials(audience, request)
+
+        if not token:
+            raise ValueError(
+                "Google Cloud detector resolved Google credentials but could "
+                "not mint an OIDC ID token. Set CLOUDSMITH_OIDC_TOKEN to "
+                "provide a token directly."
+            )
+        return token
+
+    def _on_gce(self) -> bool:
+        from google.auth import exceptions  # pylint: disable=import-error
+        from google.auth.compute_engine import _metadata  # pylint: disable=import-error
+        from google.auth.transport.requests import (  # pylint: disable=import-error
+            Request,
+        )
+
+        try:
+            return bool(_metadata.is_on_gce(Request()))
+        except exceptions.GoogleAuthError:
+            return False
+
+    def _token_from_metadata(self, audience: str, request) -> str | None:
+        from google.auth import exceptions  # pylint: disable=import-error
+        from google.auth.compute_engine import _metadata  # pylint: disable=import-error
+
+        try:
+            token = _metadata.get(
+                request,
+                METADATA_IDENTITY_PATH,
+                params={"audience": audience, "format": "full"},
+            )
+        except exceptions.GoogleAuthError:
+            logger.debug("GCPDetector: metadata id token fetch failed", exc_info=True)
+            return None
+        if not isinstance(token, str):
+            return None
+        return token.strip() or None
+
+    def _token_from_compute_id_token_credentials(
+        self, audience: str, request
+    ) -> str | None:
+        # Cloud Build's metadata server has no identity (ID-token) endpoint, so
+        # _token_from_metadata returns nothing there. Fall back to the IAM
+        # Credentials API (generateIdToken), which the workload's service
+        # account can call for itself when granted roles/iam.serviceAccountTokenCreator.
+        from google.auth import (  # pylint: disable=import-error
+            compute_engine,
+            exceptions,
+        )
+
+        try:
+            id_credentials = compute_engine.IDTokenCredentials(
+                request,
+                target_audience=audience,
+                use_metadata_identity_endpoint=False,
+            )
+            id_credentials.refresh(request)
+        except exceptions.GoogleAuthError:
+            logger.debug(
+                "GCPDetector: compute ID token credentials fetch failed",
+                exc_info=True,
+            )
+            return None
+        return id_credentials.token or None
+
+    def _token_from_user_credentials(self, credentials, request) -> str | None:
+        from google.auth import exceptions  # pylint: disable=import-error
+
+        try:
+            credentials.refresh(request)
+        except exceptions.GoogleAuthError:
+            logger.debug("GCPDetector: ADC id_token refresh failed", exc_info=True)
+            return None
+        return getattr(credentials, "id_token", None) or None
+
+    def _token_from_id_token_credentials(self, audience: str, request) -> str | None:
+        from google.auth import exceptions  # pylint: disable=import-error
+        from google.oauth2 import id_token  # pylint: disable=import-error
+
+        try:
+            id_credentials = id_token.fetch_id_token_credentials(audience, request)
+            id_credentials.refresh(request)
+            return id_credentials.token or None
+        except exceptions.GoogleAuthError:
+            logger.debug(
+                "GCPDetector: ID token credentials fetch failed", exc_info=True
+            )
+            return None

cloudsmith_cli/core/credentials/oidc/detectors/github_actions.py

@@ -16,9 +16,7 @@
 from urllib.parse import quote
 
 from ....rest import create_requests_session as create_session
-from .base import EnvironmentDetector
-
-DEFAULT_AUDIENCE = "cloudsmith"
+from .base import DEFAULT_AUDIENCE, EnvironmentDetector
 
 
 class GitHubActionsDetector(EnvironmentDetector):