refactor: apply code review fixes to GCP OIDC detector

- Cache ADC credentials resolved during detect() and reuse them in
  get_token(), avoiding a second metadata-server probe per token mint
- Hoist DEFAULT_AUDIENCE into detectors.base and import it in the AWS,
  GCP, and GitHub Actions detectors
- Replace the file-wide pylint import-error disable with per-line
  suppressions, matching the AWS detector convention
- Reuse a single transport Request for all calls within a token mint
- Log a debug message when a custom oidc_audience is ignored on the
  user-credentials path
- Install the gcp extra in the CI test workflow so the detector tests
  run instead of silently skipping via importorskip
- Add the copyright header and extend the README optional-extras note
  to cover the GCP detector

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: cloudsmith-iduffy

.github/workflows/test.yml

@@ -39,7 +39,7 @@ jobs:
           pip install -r requirements.txt
 
       - name: Install package
-        run: pip install -e .
+        run: pip install -e ".[gcp]"
 
       - name: Run pytest
         env:

README.md

@@ -181,7 +181,7 @@ To install all optional dependencies:
 pip install cloudsmith-cli[all]
 ```
 
-**Note:** If you don't install the AWS extra, the AWS OIDC detector will gracefully skip itself with no errors.
+**Note:** If you don't install the AWS or GCP extras, the corresponding OIDC detectors will gracefully skip themselves with no errors.
 
 #### Azure DevOps OIDC Support
 

cloudsmith_cli/core/credentials/oidc/detectors/aws.py

@@ -13,12 +13,10 @@
 
 import logging
 
-from .base import EnvironmentDetector
+from .base import DEFAULT_AUDIENCE, EnvironmentDetector
 
 logger = logging.getLogger(__name__)
 
-DEFAULT_AUDIENCE = "cloudsmith"
-
 
 class AWSDetector(EnvironmentDetector):
     """Detects AWS environments and obtains a JWT via STS GetWebIdentityToken."""

cloudsmith_cli/core/credentials/oidc/detectors/base.py

@@ -7,6 +7,8 @@
 if TYPE_CHECKING:
     from ... import CredentialContext
 
+DEFAULT_AUDIENCE = "cloudsmith"
+
 
 class EnvironmentDetector:
     """Base class for OIDC environment detectors."""

cloudsmith_cli/core/credentials/oidc/detectors/gcp.py

@@ -1,3 +1,4 @@
+# Copyright 2026 Cloudsmith Ltd
 """Google Cloud OIDC detector.
 
 Discovers the ambient Google identity via google-auth's Application Default
@@ -12,19 +13,14 @@
     https://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth
 """
 
-# google-auth is an optional dependency; its imports are unavailable at lint time.
-# pylint: disable=import-error
-
 from __future__ import annotations
 
 import logging
 
-from .base import EnvironmentDetector
+from .base import DEFAULT_AUDIENCE, EnvironmentDetector
 
 logger = logging.getLogger(__name__)
 
-DEFAULT_AUDIENCE = "cloudsmith"
-
 METADATA_IDENTITY_PATH = "instance/service-accounts/default/identity"
 
 
@@ -33,6 +29,10 @@ class GCPDetector(EnvironmentDetector):
 
     name = "Google Cloud"
 
+    def __init__(self, context):
+        super().__init__(context)
+        self._credentials = None
+
     def detect(self) -> bool:
         try:
             import google.auth
@@ -42,7 +42,7 @@ def detect(self) -> bool:
             return False
 
         try:
-            google.auth.default()
+            self._credentials, _ = google.auth.default()
             return True
         except exceptions.DefaultCredentialsError:
             return self._on_gce()
@@ -53,27 +53,41 @@ def detect(self) -> bool:
     def get_token(self) -> str:
         audience = self.context.oidc_audience or DEFAULT_AUDIENCE
 
-        import google.auth
-        from google.auth import compute_engine, exceptions
-        from google.auth.transport.requests import Request
-        from google.oauth2 import credentials as user_creds
+        import google.auth  # pylint: disable=import-error
+        from google.auth import (  # pylint: disable=import-error
+            compute_engine,
+            exceptions,
+        )
+        from google.auth.transport.requests import (  # pylint: disable=import-error
+            Request,
+        )
+        from google.oauth2 import (  # pylint: disable=import-error
+            credentials as user_creds,
+        )
 
         request = Request()
-        try:
-            credentials, _ = google.auth.default()
-        except exceptions.DefaultCredentialsError:
-            token = self._token_from_metadata(audience)
+        credentials = self._credentials
+        if credentials is None:
+            try:
+                credentials, _ = google.auth.default()
+            except exceptions.DefaultCredentialsError:
+                credentials = None
+
+        if credentials is None:
+            token = self._token_from_metadata(audience, request)
+        elif isinstance(credentials, compute_engine.Credentials):
+            token = self._token_from_metadata(audience, request)
+            if not token:
+                token = self._token_from_compute_id_token_credentials(audience, request)
+        elif isinstance(credentials, user_creds.Credentials):
+            if self.context.oidc_audience:
+                logger.debug(
+                    "GCPDetector: user credentials cannot mint a token for a "
+                    "custom audience; the configured oidc_audience is ignored"
+                )
+            token = self._token_from_user_credentials(credentials, request)
         else:
-            if isinstance(credentials, compute_engine.Credentials):
-                token = self._token_from_metadata(audience)
-                if not token:
-                    token = self._token_from_compute_id_token_credentials(
-                        audience, request
-                    )
-            elif isinstance(credentials, user_creds.Credentials):
-                token = self._token_from_user_credentials(credentials, request)
-            else:
-                token = self._token_from_id_token_credentials(audience, request)
+            token = self._token_from_id_token_credentials(audience, request)
 
         if not token:
             raise ValueError(
@@ -84,23 +98,24 @@ def get_token(self) -> str:
         return token
 
     def _on_gce(self) -> bool:
-        from google.auth import exceptions
-        from google.auth.compute_engine import _metadata
-        from google.auth.transport.requests import Request
+        from google.auth import exceptions  # pylint: disable=import-error
+        from google.auth.compute_engine import _metadata  # pylint: disable=import-error
+        from google.auth.transport.requests import (  # pylint: disable=import-error
+            Request,
+        )
 
         try:
             return bool(_metadata.is_on_gce(Request()))
         except exceptions.GoogleAuthError:
             return False
 
-    def _token_from_metadata(self, audience: str) -> str | None:
-        from google.auth import exceptions
-        from google.auth.compute_engine import _metadata
-        from google.auth.transport.requests import Request
+    def _token_from_metadata(self, audience: str, request) -> str | None:
+        from google.auth import exceptions  # pylint: disable=import-error
+        from google.auth.compute_engine import _metadata  # pylint: disable=import-error
 
         try:
             token = _metadata.get(
-                Request(),
+                request,
                 METADATA_IDENTITY_PATH,
                 params={"audience": audience, "format": "full"},
             )
@@ -118,7 +133,10 @@ def _token_from_compute_id_token_credentials(
         # _token_from_metadata returns nothing there. Fall back to the IAM
         # Credentials API (generateIdToken), which the workload's service
         # account can call for itself when granted roles/iam.serviceAccountTokenCreator.
-        from google.auth import compute_engine, exceptions
+        from google.auth import (  # pylint: disable=import-error
+            compute_engine,
+            exceptions,
+        )
 
         try:
             id_credentials = compute_engine.IDTokenCredentials(
@@ -136,7 +154,7 @@ def _token_from_compute_id_token_credentials(
         return id_credentials.token or None
 
     def _token_from_user_credentials(self, credentials, request) -> str | None:
-        from google.auth import exceptions
+        from google.auth import exceptions  # pylint: disable=import-error
 
         try:
             credentials.refresh(request)
@@ -146,8 +164,8 @@ def _token_from_user_credentials(self, credentials, request) -> str | None:
         return getattr(credentials, "id_token", None) or None
 
     def _token_from_id_token_credentials(self, audience: str, request) -> str | None:
-        from google.auth import exceptions
-        from google.oauth2 import id_token
+        from google.auth import exceptions  # pylint: disable=import-error
+        from google.oauth2 import id_token  # pylint: disable=import-error
 
         try:
             id_credentials = id_token.fetch_id_token_credentials(audience, request)

cloudsmith_cli/core/credentials/oidc/detectors/github_actions.py

@@ -16,9 +16,7 @@
 from urllib.parse import quote
 
 from ....rest import create_requests_session as create_session
-from .base import EnvironmentDetector
-
-DEFAULT_AUDIENCE = "cloudsmith"
+from .base import DEFAULT_AUDIENCE, EnvironmentDetector
 
 
 class GitHubActionsDetector(EnvironmentDetector):

cloudsmith_cli/core/tests/test_gcp_detector.py

@@ -73,6 +73,16 @@ def test_uses_configured_audience(self):
         _, kwargs = get.call_args
         assert kwargs["params"]["audience"] == "custom-aud"
 
+    def test_get_token_reuses_credentials_resolved_during_detect(self):
+        compute_creds = mock.Mock(spec=compute_engine.Credentials)
+        detector = make_detector()
+        with mock.patch(
+            "google.auth.default", return_value=(compute_creds, "proj")
+        ) as default, mock.patch(METADATA_GET, return_value="meta-jwt"):
+            assert detector.detect() is True
+            assert detector.get_token() == "meta-jwt"
+        default.assert_called_once()
+
     def test_falls_back_to_metadata_when_default_raises(self):
         with mock.patch(
             "google.auth.default",