[cloudsmith-iduffy]

Description

cloudsmith whoami --verbose shows a credential from OIDC auto-discovery as a SAML session. In CI, this hides how the CLI authenticated:

User: circlci (slug: circlci)

Authentication Method: SAML Token (primary)

The cause:

• Since fix: stop recurring macOS keychain prompts and self-heal dead SSO sessions #383 (first released in 1.26.0), the OIDC provider returns the exchanged token with auth_type="bearer", so the CLI sends it in an Authorization: Bearer header.
• _get_active_method() treats every bearer header as a SAML session (sso_token).
• The SAML branch reads its Source from the system keyring, so OIDC credentials get no source.
• The OIDC Auto-Discovery label from feat: add OIDC credential auto-discovery #276 sat in the API key branch, which an OIDC credential no longer reaches.

This PR detects an OIDC credential from the credential chain (source_name == "oidc") before it looks at the headers. After the fix:

User: CI service (slug: ci-service)

Authentication Method: OIDC Auto-Discovery
  Source: OIDC via GitHub Actions (org: acme, service: ci-service)

With -F json, auth.active_method is oidc instead of sso_token, and the new auth.oidc object gives configured and source.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

• Tests for the label: 3 new tests in cloudsmith_cli/cli/tests/commands/test_whoami.py for the text output, the JSON output, and a SAML session, which still shows as SAML Token (primary). The OIDC tests failed before the fix. The full unit suite and pre-commit pass.
• JSON consumers: anyone who reads active_method gets oidc instead of sso_token for OIDC credentials. The changelog entry says so.
• Cached tokens: most commands in a CI job after the first one use the cached token, which showed OIDC [cached] (org: …, service: …) without the CI vendor. The provider reads the cache before it detects the environment. The second commit stores the detector name with the cached token, so the source is now, for example, OIDC via GitHub Actions [cached] (org: …, service: …). A token that an earlier version cached keeps the old source until it expires. Tests: 3 provider tests and a new test_oidc_cache.py for the disk and keyring paths.
• End-to-end check in GitHub Actions: this run installed the CLI from this branch and ran whoami --verbose twice with GitHub OIDC. The first run printed Authentication Method: OIDC Auto-Discovery and Source: OIDC via GitHub Actions (org: iduffy-demo, service: github-c3xe). The second run, from the cache, printed Source: OIDC via GitHub Actions [cached] (org: iduffy-demo, service: github-c3xe).

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The focused fix matches the credential-chain contract, includes regression coverage, and has no identified blocking issues.

No open issues 🎉

What changed in this PR

Corrects whoami --verbose so OIDC credentials are identified by their credential-chain source rather than mistaken for SAML bearer tokens.

Changes:

• Displays OIDC authentication and its source in verbose text and JSON output.
• Adds regression tests for OIDC output and unchanged SAML labeling.
• Documents the JSON authentication-field changes in the changelog.

File	Description
cloudsmith_cli/​cli/​tests/​commands/​test_whoami.py	Adds OIDC text/JSON tests and a SAML regression test.
cloudsmith_cli/​cli/​commands/​whoami.py	Detects OIDC credentials and reports their authentication source.
CHANGELOG.md	Documents the corrected display and JSON fields.

_{Review effort: Balanced}

[cloudsmith-iduffy]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merged master and resolved both conflicts in merge commit c65147b. The merge is pushed; targeted pytest could not run because uv and pytest are unavailable.

[Copilot]

🟢 Approval recommended

There are no active review issues for the OIDC authentication-reporting changes.

No open issues 🎉

_{Review effort: Balanced}