Repository navigation
feat: add Buildkite OIDC credential detection - #415
Merged
cloudsmith-iduffy merged 4 commits intoOct 5, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
No unresolved review issues were identified.
Review effort: Lite
Findings: None
What changed in this PR
Adds Buildkite OIDC credential detection and token retrieval to the CLI.
Changes:
- Detects Buildkite jobs and requests OIDC tokens via
buildkite-agent. - Supports configurable audiences, defaulting to
cloudsmith. - Registers, documents, and tests the new detector.
| File | Description |
|---|---|
README.md |
Documents Buildkite OIDC support and detector ID. |
cloudsmith_cli/core/tests/test_buildkite_detector.py |
Tests detection, token retrieval, audiences, and integration. |
cloudsmith_cli/core/credentials/oidc/detectors/buildkite.py |
Implements Buildkite OIDC detection and token retrieval. |
cloudsmith_cli/core/credentials/oidc/detectors/__init__.py |
Registers the Buildkite detector. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
tigh-latte
reviewed
Oct 2, 2026
tigh-latte
approved these changes
Oct 5, 2026
Co-authored-by: cloudsmith-iduffy <178375997+cloudsmith-iduffy@users.noreply.github.com>
cloudsmith-iduffy
force-pushed
the
cloudsmith-iduffy-buildkite-oidc-detector
branch
from
October 5, 2026 17:39
7af3693 to
38426e6
Compare
cloudsmith-iduffy
deleted the
cloudsmith-iduffy-buildkite-oidc-detector
branch
October 5, 2026 17:40
tigh-latte
added a commit
that referenced
this pull request
Oct 7, 2026
This reverts commit d6da221.
tigh-latte
added a commit
that referenced
this pull request
Oct 7, 2026
This reverts commit 3b5c328.
tigh-latte
added a commit
that referenced
this pull request
Oct 7, 2026
This reverts commit 3b5c328.
tigh-latte
added a commit
that referenced
this pull request
Oct 8, 2026
* Reapply "feat: add Buildkite OIDC credential detection (#415)" This reverts commit 3b5c328. * Reapply "feat: add Google Cloud OIDC detector (#306)" This reverts commit f194d83. * Potential fix for pull request finding 'Add Buildkite OIDC detector to the changelog' Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
BUILDKITEandBUILDKITE_JOB_IDbuildkite-agent oidc request-token--oidc-audience/CLOUDSMITH_OIDC_AUDIENCEoverride, defaulting tocloudsmithbuildkitedetectorTesting
uv run pytest -q cloudsmith_cli/core/tests/test_buildkite_detector.py cloudsmith_cli/core/tests/test_detector_controls.pyenv -u CLOUDSMITH_WORKSPACE -u CLOUDSMITH_ORG uv run pytest -q -m 'not integration'uv run pre-commit run --files cloudsmith_cli/core/credentials/oidc/detectors/buildkite.py cloudsmith_cli/core/credentials/oidc/detectors/__init__.py cloudsmith_cli/core/tests/test_buildkite_detector.py README.mdEnd-to-end validation
The detector was validated end to end with the reproducible
cloudsmith-iduffy/cloudsmith-cli-oidc-testharness. Its Buildkite pipeline configuration downloads the Linux x86_64 GNU standalone binary built from this PR's commitff2c7ceabcb6126643fc6c0e1b92b620eee0be1b, verifies its pinned SHA256, rejectsCLOUDSMITH_API_KEY, and runscloudsmith --debug whoami --verbosewith an isolated home directory.whoamioutput: Cloudsmith OIDC smoke-test jobNo Cloudsmith API key was supplied or available to the job; authentication used the Buildkite-issued OIDC token with audience
cloudsmith.