fix: deduplicate ids in --oidc-detector-order

Duplicate detector ids in the order list previously ran the same
detector once per occurrence, which is wasteful for detectors that hit
metadata endpoints (e.g. AWS STS/IMDS). Duplicates now keep their first
position so each detector is evaluated at most once. Also log at debug
when the order/disable controls leave no detectors enabled, so an order
string with no usable ids is diagnosable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: cloudsmith-iduffy

cloudsmith_cli/core/credentials/oidc/detectors/__init__.py

@@ -61,24 +61,25 @@ def _ordered_detectors(order: str | None) -> list[type[EnvironmentDetector]]:
 
     When ``order`` is unset/empty the default registration order is used.
     Otherwise only the listed ids are considered, in the listed order;
-    unknown ids are logged and skipped.
+    unknown ids are logged and skipped, and duplicate ids keep their first
+    position so each detector is evaluated at most once.
     """
     raw_order = (order or "").strip()
     if not raw_order:
         return list(_DETECTORS)
 
     detectors_by_id = {detector_cls.id: detector_cls for detector_cls in _DETECTORS}
-    ordered: list[type[EnvironmentDetector]] = []
+    ordered: dict[str, type[EnvironmentDetector]] = {}
     for token in raw_order.split(","):
         identifier = token.strip().lower()
-        if not identifier:
+        if not identifier or identifier in ordered:
             continue
         detector_cls = detectors_by_id.get(identifier)
         if detector_cls is None:
             logger.debug("Ignoring unknown OIDC detector id: %s", identifier)
             continue
-        ordered.append(detector_cls)
-    return ordered
+        ordered[identifier] = detector_cls
+    return list(ordered.values())
 
 
 def _enabled_detectors(
@@ -99,6 +100,8 @@ def detect_environment(
     enabled = _enabled_detectors(
         context.oidc_detector_order, context.oidc_disabled_detectors
     )
+    if not enabled:
+        logger.debug("No OIDC detectors enabled after applying order/disable controls")
     for detector_cls in enabled:
         detector = detector_cls(context=context)
         try:

cloudsmith_cli/core/tests/test_detector_controls.py

@@ -1,6 +1,7 @@
 # Copyright 2026 Cloudsmith Ltd
 """Tests for OIDC detector selection controls (disable set + order)."""
 
+import logging
 from unittest import mock
 
 import pytest
@@ -116,6 +117,21 @@ def test_empty_order_falls_back_to_default(self, fake_detectors):
         detector = detect_environment(_context(oidc_detector_order="   "))
         assert isinstance(detector, AlphaDetector)
 
+    def test_duplicate_ids_run_each_detector_once(self, fake_detectors):
+        with mock.patch.object(
+            AlphaDetector, "detect", return_value=False
+        ) as alpha_detect:
+            detector = detect_environment(
+                _context(oidc_detector_order="alpha,alpha,bravo")
+            )
+        assert isinstance(detector, BravoDetector)
+        assert alpha_detect.call_count == 1
+
+    def test_order_with_no_usable_ids_disables_detection(self, fake_detectors, caplog):
+        with caplog.at_level(logging.DEBUG):
+            assert detect_environment(_context(oidc_detector_order="nope,!")) is None
+        assert "No OIDC detectors enabled" in caplog.text
+
 
 class TestOrderAndDisableCompose:
     def test_disable_wins_over_order(self, fake_detectors):