feat: add GitLab CI OIDC detector

[cloudsmith-iduffy]

Summary

Adds a GitLab CI environment detector to the OIDC credential auto-discovery chain. When the CLI runs inside a GitLab pipeline, it reads an OIDC JWT minted by GitLab's id_tokens configuration and exchanges it for a short-lived Cloudsmith API token — no static API key required.

Behaviour

• Detects via GITLAB_CI=true plus a token environment variable.
• Reads the token from CLOUDSMITH_OIDC_TOKEN, falling back to the legacy CI_JOB_JWT_V2 / CI_JOB_JWT variables.
• Registered ahead of the AWS detector, so a GitLab pipeline that happens to carry incidental AWS credentials still authenticates as GitLab CI.
• No new dependencies — the token is already present in the job environment, so detection and retrieval are plain env reads.

Usage

job:
  id_tokens:
    CLOUDSMITH_OIDC_TOKEN:
      aud: "https://api.cloudsmith.io/openid/<your-org>"
  script:
    - cloudsmith push ...

The aud must be https://api.cloudsmith.io/openid/<org> — that is the audience the Cloudsmith OIDC endpoint validates.

Testing

• 10 unit tests covering detection (env-var combinations, GITLAB_CI flag) and token retrieval (preference order, legacy fallback, missing-token error). black/isort/flake8/pylint clean.
• Verified end-to-end on a real GitLab pipeline: the detector identified the environment, read the GitLab-minted id_token, exchanged it at POST /openid/<org>/ with the service slug, and cloudsmith whoami returned is_authenticated: true as the service account — authenticating purely via OIDC with no API key.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds GitLab CI/CD as a first-class OIDC auto-discovery environment for the CLI’s credential resolution chain, enabling GitLab pipelines to authenticate to Cloudsmith using a GitLab-minted OIDC JWT (instead of a static API key).

Changes:

• Added a GitLabCIDetector that detects GitLab CI and retrieves an OIDC JWT from CLOUDSMITH_OIDC_TOKEN (with legacy fallbacks).
• Registered the GitLab detector ahead of the AWS detector in the OIDC environment detection order.
• Added unit tests for detection behavior and token retrieval precedence, and documented GitLab CI OIDC usage in the README.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
README.md	Documents GitLab CI OIDC configuration and usage example.
cloudsmith_cli/core/tests/test_gitlab_ci_detector.py	Adds unit tests for GitLab CI detection and token selection behavior.
cloudsmith_cli/core/credentials/oidc/detectors/gitlab_ci.py	Implements the GitLab CI OIDC environment detector.
cloudsmith_cli/core/credentials/oidc/detectors/init.py	Registers GitLab CI detector ahead of AWS in the detection chain.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[BartoszBlizniak]

pre-apprv