[AIENG-679] Unify GitHub Actions OIDC onto the generic OIDC flow

[gokul-cloudbees]

Summary

Routes GitHub Actions OIDC through the same generic flow used for Jenkins. The legacy path is preserved behind an explicit opt-in.

Changes

• New env var SMART_TESTS_GITHUB_OIDC_TOKEN_AUTH=1. CLI fetches the runner's id-token with audience=https://app.cloudbees.io/smart-tests and presents it as a plain OIDC bearer (same code path as SMART_TESTS_OIDC_TOKEN for Jenkins)
  • Legacy env var EXPERIMENTAL_GITHUB_OIDC_TOKEN_AUTH=1 still works, but now: Fetches the id-token without an audience (as before).
    • Adds the GitHub-OIDC-Legacy: 1 header so Intake routes to the legacy verifier.
    • Prints a deprecation warning pointing at the migration doc.
  • Added OIDC_AUDIENCE_KEY for callers that need a non-default audience.

[ono-max]

Should we modify the Java part? I guess we need to do the same thing there, too.

smart-tests-cli/src/main/java/com/launchableinc/ingest/commits/Main.java

Lines 87 to 125 in c57ddb1

	/** Ensures all the configuration is properly in place. */
	private void parseConfiguration() throws CmdLineException {
	String apiToken = launchableToken;
	if (launchableToken == null) {
	apiToken = System.getenv("SMART_TESTS_TOKEN");
	}
	if (apiToken == null || apiToken.isEmpty()) {
	if (System.getenv("GITHUB_ACTIONS") != null) {
	String o = System.getenv("SMART_TESTS_ORGANIZATION");
	if (org == null && o == null) {
	throw new CmdLineException("SMART_TESTS_ORGANIZATION env variable is not set");
	}
	String w = System.getenv("SMART_TESTS_WORKSPACE");
	if (ws == null && w == null) {
	throw new CmdLineException("SMART_TESTS_WORKSPACE env variable is not set");
	}
	if (org == null) {
	this.org = o;
	}
	if (ws == null) {
	this.ws = w;
	}
	if (System.getenv("EXPERIMENTAL_GITHUB_OIDC_TOKEN_AUTH") != null) {
	authenticator = new GitHubIdTokenAuthenticator();
	} else {
	authenticator = new GitHubActionsAuthenticator();
	}
	return;
	}
	throw new CmdLineException("SMART_TESTS_TOKEN env variable is not set");
	}
	this.parseLaunchableToken(apiToken);
	}

[ono-max]

This warning is within authentication_headers method, meaning that CLI will print it every time API is called. It might be annoyed, so can we think about a way to reduce the frequency?

[ono-max]

Nit: You can use https://guava.dev/releases/17.0/api/docs/com/google/common/base/Strings.html#isNullOrEmpty(java.lang.String)

[ono-max]

Same as https://github.com/cloudbees-oss/smart-tests-cli/pull/1366/changes#r3909876451

[ono-max]

Same as https://github.com/cloudbees-oss/smart-tests-cli/pull/1366/changes#r3909876451

[ono-max]

In the following code, we first check if SMART_TESTS_OIDC_TOKEN exists in get_oidc_token() method, right? However, in the new OIDC flow for GH, we are asking users to configure SMART_TESTS_GITHUB_OIDC_TOKEN_AUTH, not SMART_TESTS_OIDC_TOKEN. Do we need to check SMART_TESTS_GITHUB_OIDC_TOKEN_AUTH in verify_oidc() method?

smart-tests-cli/smart_tests/commands/verify.py

Lines 202 to 226 in 1fc2b8e

	def verify_oidc(app_instance: Application):
	'''
	Credential-free OIDC bootstrap. Presents the pipeline's OIDC id-token to Intake's
	/intake/oidc/verify endpoint and translates the 200/403/401 contract into CLI behavior:
	- 200: the subject is registered. Print `export` lines (org/workspace/oidc-token) so the
	pipeline can `eval "$(smart-tests verify --oidc)"` and authenticate subsequent
	commands with the same token. Exit 0.
	- 403: the token verified but its subject isn't registered to any workspace yet. Show the
	normalized `sub` so the user can register it from the WebApp settings. Exit 1.
	- 401: the token is missing/expired/invalid. Exit 1.
	'''
	tracking_client = TrackingClient(Command.VERIFY, app=app_instance)
	token = get_oidc_token()
	if not token:
	msg = (f"OIDC authentication requires the {OIDC_TOKEN_KEY} environment variable to hold the "
	"pipeline's OIDC id-token. In Jenkins, bind an id-token credential to this variable; "
	"see the OIDC pipeline-authentication setup guide.")
	click.secho(msg, fg='red', err=True)
	tracking_client.send_error_event(
	event_name=Tracking.ErrorEvent.USER_ERROR,
	stack_trace=msg,
	)
	raise typer.Exit(2)

[ono-max]

@gokul-cloudbees

The following comments are just trivial changes, so you don't have to address them, but the last comment here might be critical, so you can focus on it.

#1366 (comment)
#1366 (comment)
#1366 (comment)