feat: add Bitbucket Pipelines OIDC detector

Reads the OIDC token from BITBUCKET_STEP_OIDC_TOKEN, which Bitbucket
populates when a pipeline step sets oidc: true.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cloudsmith-iduffy

cloudsmith_cli/core/credentials/oidc/detectors/__init__.py

@@ -7,13 +7,15 @@
 
 from .aws import AWSDetector
 from .base import EnvironmentDetector
+from .bitbucket_pipelines import BitbucketPipelinesDetector
 
 if TYPE_CHECKING:
     from ... import CredentialContext
 
 logger = logging.getLogger(__name__)
 
 _DETECTORS: list[type[EnvironmentDetector]] = [
+    BitbucketPipelinesDetector,
     AWSDetector,
 ]
 

cloudsmith_cli/core/credentials/oidc/detectors/bitbucket_pipelines.py

@@ -0,0 +1,33 @@
+"""Bitbucket Pipelines OIDC detector.
+
+Reads an OIDC token from the ``BITBUCKET_STEP_OIDC_TOKEN`` environment variable,
+which Bitbucket populates when ``oidc: true`` is set on a pipeline step.
+
+References:
+    https://support.atlassian.com/bitbucket-cloud/docs/integrate-pipelines-with-resource-servers-using-oidc/
+    https://support.atlassian.com/bitbucket-cloud/docs/variables-and-secrets/
+"""
+
+from __future__ import annotations
+
+import os
+
+from .base import EnvironmentDetector
+
+
+class BitbucketPipelinesDetector(EnvironmentDetector):
+    """Detects Bitbucket Pipelines and reads its OIDC token from environment."""
+
+    name = "Bitbucket Pipelines"
+
+    def detect(self) -> bool:
+        return bool(os.environ.get("BITBUCKET_STEP_OIDC_TOKEN"))
+
+    def get_token(self) -> str:
+        token = os.environ.get("BITBUCKET_STEP_OIDC_TOKEN")
+        if not token:
+            raise ValueError(
+                "Bitbucket Pipelines detected but BITBUCKET_STEP_OIDC_TOKEN is not "
+                "set. Enable OIDC on the pipeline step with 'oidc: true'."
+            )
+        return token

cloudsmith_cli/core/tests/test_bitbucket_pipelines_detector.py

@@ -0,0 +1,48 @@
+"""Tests for the Bitbucket Pipelines OIDC detector."""
+
+from unittest import mock
+
+import pytest
+
+from cloudsmith_cli.core.credentials.models import CredentialContext
+from cloudsmith_cli.core.credentials.oidc.detectors.bitbucket_pipelines import (
+    BitbucketPipelinesDetector,
+)
+
+
+@pytest.fixture
+def bitbucket_env():
+    env = {
+        "BITBUCKET_STEP_OIDC_TOKEN": "the-jwt",
+    }
+    with mock.patch.dict("os.environ", env, clear=True):
+        yield env
+
+
+class TestDetect:
+    def test_detects_when_token_present(self, bitbucket_env):
+        detector = BitbucketPipelinesDetector(context=CredentialContext())
+        assert detector.detect() is True
+
+    def test_not_detected_when_unset(self):
+        with mock.patch.dict("os.environ", {}, clear=True):
+            detector = BitbucketPipelinesDetector(context=CredentialContext())
+            assert detector.detect() is False
+
+    def test_not_detected_when_token_empty(self, bitbucket_env):
+        bitbucket_env["BITBUCKET_STEP_OIDC_TOKEN"] = ""
+        with mock.patch.dict("os.environ", bitbucket_env, clear=True):
+            detector = BitbucketPipelinesDetector(context=CredentialContext())
+            assert detector.detect() is False
+
+
+class TestGetToken:
+    def test_returns_token(self, bitbucket_env):
+        detector = BitbucketPipelinesDetector(context=CredentialContext())
+        assert detector.get_token() == "the-jwt"
+
+    def test_raises_when_token_missing(self):
+        with mock.patch.dict("os.environ", {}, clear=True):
+            detector = BitbucketPipelinesDetector(context=CredentialContext())
+            with pytest.raises(ValueError):
+                detector.get_token()