fix: mint OIDC token via IAM Credentials on Cloud Build

Cloud Build workers run as a service account but their metadata server
exposes no identity (ID-token) endpoint, so _token_from_metadata 404s
and the detector failed on Cloud Build despite it being listed as
supported. Fall back to compute_engine.IDTokenCredentials
(use_metadata_identity_endpoint=False), which mints the ID token via the
IAM Credentials API. Requires the runtime SA to hold
roles/iam.serviceAccountTokenCreator on itself.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cloudsmith-iduffy

CHANGELOG.md

@@ -10,7 +10,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ### Added
 
-- Added Google Cloud (GCP) support to OIDC credential auto-discovery. Install with the `gcp` extra (`pip install cloudsmith-cli[gcp]`) to authenticate using the ambient Google Cloud identity: the attached service account on GCE/Cloud Run/GKE/Cloud Functions/App Engine/Cloud Build, a `GOOGLE_APPLICATION_CREDENTIALS` service-account key, or a local `gcloud auth application-default login` session. The CLI discovers credentials via the `google-auth` SDK's Application Default Credentials chain, mints a short-lived OIDC ID token, and exchanges it for a Cloudsmith access token. Without the extra installed, the detector skips itself with no errors.
+- Added Google Cloud (GCP) support to OIDC credential auto-discovery. Install with the `gcp` extra (`pip install cloudsmith-cli[gcp]`) to authenticate using the ambient Google Cloud identity: the attached service account on GCE/Cloud Run/GKE/Cloud Functions/App Engine/Cloud Build, a `GOOGLE_APPLICATION_CREDENTIALS` service-account key, or a local `gcloud auth application-default login` session. The CLI discovers credentials via the `google-auth` SDK's Application Default Credentials chain, mints a short-lived OIDC ID token, and exchanges it for a Cloudsmith access token. On Cloud Build, where the metadata server exposes no ID-token endpoint, the token is minted via the IAM Credentials API (`generateIdToken`), which requires the build service account to hold `roles/iam.serviceAccountTokenCreator` on itself. Without the extra installed, the detector skips itself with no errors.
 
 ## [1.17.0] - 2026-05-18
 

README.md

@@ -165,6 +165,14 @@ pip install cloudsmith-cli[gcp]
 
 This installs `google-auth` for Application Default Credentials resolution and OIDC ID token generation. It works with the attached service account on Google Cloud workloads, a `GOOGLE_APPLICATION_CREDENTIALS` service-account key, or a local `gcloud auth application-default login` session. See Google's [Authenticate with auth libraries](https://docs.cloud.google.com/iam/docs/authenticate-with-auth-libraries#authenticate-standard) guide for how credentials are resolved.
 
+On **Cloud Build** the metadata server does not expose an ID-token endpoint, so the CLI mints the token via the IAM Credentials API instead. This requires the build's runtime service account to be able to create tokens for itself — grant it `roles/iam.serviceAccountTokenCreator` on itself:
+
+```
+gcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT_EMAIL \
+  --member="serviceAccount:SERVICE_ACCOUNT_EMAIL" \
+  --role="roles/iam.serviceAccountTokenCreator"
+```
+
 #### All Optional Features
 
 To install all optional dependencies:

cloudsmith_cli/core/credentials/oidc/detectors/gcp.py

@@ -66,6 +66,10 @@ def get_token(self) -> str:
         else:
             if isinstance(credentials, compute_engine.Credentials):
                 token = self._token_from_metadata(audience)
+                if not token:
+                    token = self._token_from_compute_id_token_credentials(
+                        audience, request
+                    )
             elif isinstance(credentials, user_creds.Credentials):
                 token = self._token_from_user_credentials(credentials, request)
             else:
@@ -107,6 +111,30 @@ def _token_from_metadata(self, audience: str) -> str | None:
             return None
         return token.strip() or None
 
+    def _token_from_compute_id_token_credentials(
+        self, audience: str, request
+    ) -> str | None:
+        # Cloud Build's metadata server has no identity (ID-token) endpoint, so
+        # _token_from_metadata returns nothing there. Fall back to the IAM
+        # Credentials API (generateIdToken), which the workload's service
+        # account can call for itself when granted roles/iam.serviceAccountTokenCreator.
+        from google.auth import compute_engine, exceptions
+
+        try:
+            id_credentials = compute_engine.IDTokenCredentials(
+                request,
+                target_audience=audience,
+                use_metadata_identity_endpoint=False,
+            )
+            id_credentials.refresh(request)
+        except exceptions.GoogleAuthError:
+            logger.debug(
+                "GCPDetector: compute ID token credentials fetch failed",
+                exc_info=True,
+            )
+            return None
+        return id_credentials.token or None
+
     def _token_from_user_credentials(self, credentials, request) -> str | None:
         from google.auth import exceptions
 

cloudsmith_cli/core/tests/test_gcp_detector.py

@@ -15,6 +15,7 @@
 METADATA_GET = "google.auth.compute_engine._metadata.get"
 METADATA_IS_ON_GCE = "google.auth.compute_engine._metadata.is_on_gce"
 FETCH_ID_TOKEN_CREDS = "google.oauth2.id_token.fetch_id_token_credentials"
+COMPUTE_ID_TOKEN_CREDS = "google.auth.compute_engine.IDTokenCredentials"
 
 
 def make_detector(**ctx):
@@ -79,19 +80,42 @@ def test_falls_back_to_metadata_when_default_raises(self):
         ), mock.patch(METADATA_GET, return_value="meta-jwt"):
             assert make_detector().get_token() == "meta-jwt"
 
-    def test_raises_when_metadata_returns_blank(self):
+    def test_falls_back_to_id_token_credentials_when_metadata_blank(self):
+        # Cloud Build exposes no metadata identity endpoint (404 -> blank), so
+        # the compute path must fall back to IAM Credentials generateIdToken.
         compute_creds = mock.Mock(spec=compute_engine.Credentials)
+        id_creds = mock.Mock(token="fallback-jwt")
         with mock.patch(
             "google.auth.default", return_value=(compute_creds, "proj")
-        ), mock.patch(METADATA_GET, return_value="   "):
-            with pytest.raises(ValueError):
-                make_detector().get_token()
+        ), mock.patch(METADATA_GET, return_value="   "), mock.patch(
+            COMPUTE_ID_TOKEN_CREDS, return_value=id_creds
+        ) as id_token_credentials:
+            token = make_detector(oidc_audience="aud").get_token()
+        assert token == "fallback-jwt"
+        _, kwargs = id_token_credentials.call_args
+        assert kwargs["target_audience"] == "aud"
+        assert kwargs["use_metadata_identity_endpoint"] is False
+        id_creds.refresh.assert_called_once()
+
+    def test_falls_back_to_id_token_credentials_when_metadata_errors(self):
+        compute_creds = mock.Mock(spec=compute_engine.Credentials)
+        id_creds = mock.Mock(token="fallback-jwt")
+        with mock.patch(
+            "google.auth.default", return_value=(compute_creds, "proj")
+        ), mock.patch(
+            METADATA_GET, side_effect=exceptions.TransportError("boom")
+        ), mock.patch(
+            COMPUTE_ID_TOKEN_CREDS, return_value=id_creds
+        ):
+            assert make_detector().get_token() == "fallback-jwt"
 
-    def test_raises_when_metadata_errors(self):
+    def test_raises_when_metadata_and_fallback_both_fail(self):
         compute_creds = mock.Mock(spec=compute_engine.Credentials)
         with mock.patch(
             "google.auth.default", return_value=(compute_creds, "proj")
-        ), mock.patch(METADATA_GET, side_effect=exceptions.TransportError("boom")):
+        ), mock.patch(METADATA_GET, return_value="   "), mock.patch(
+            COMPUTE_ID_TOKEN_CREDS, side_effect=exceptions.RefreshError("no perm")
+        ):
             with pytest.raises(ValueError):
                 make_detector().get_token()