Description

This PR introduces functionality to return Buildkite OIDC tokens wrapped in standard JSON expected by GCP for use in Workload Identity Federation Credentials. With this change in place, using GCP Workload Identity Federation with Buildkite is greatly simplified.

Context

When using Workload Identity Federation in GCP with Buildkite, Workload Identity JSON credentials can be structured in several ways (see: External Account Credentials (Workload Identity Federation)). Notably, the most streamlined and secure way of configuring these credentials is to provide a credential_source of a command that returns a token (this nullifies the requirement to save the token anywhere along the way, and instead allows the GCP library to execute the command to fetch the token at the time its needed to exchange the token for a GCP access token).

Using an executable credential_source with Buildkite's oidc request-token command is incompatible, as the output of the executable command is expected to be in a JSON format, not the token by itself.

Moreover, using some creative bash scripting to construct a "one-liner" is incompatible as the executable credential_source, as the underlying method of executing the command in Google's libraries runs a .split() (in Python) that breaks any one-liner apart in an unusable way. For instance, something like this will not work:

buildkite-agent oidc request-token | jq -R \"{\\\"id_token\\\": ., \\\"token_type\\\": \\\"urn:ietf:params:oauth:token-type:jwt\\\", \\\"version\\\": 1, \\\"success\\\": true}\"

(Additionally, wrapping that whole thing in ' quotation marks and invoking /bin/bash, etc. won't work, either...)

Changes

This PR adds a new CLI flag, --gcp-format, to the buildkite-agent oidc request-token command. When this flag is true, the buildkite-agent oidc request-token command returns the token wrapped in JSON, as opposed to the default behavior of returning the token as a string.

Testing

• Tests have run locally (with go test ./...). Buildkite employees may check this if the pipeline has run automatically.
• Code is formatted (with go fmt ./...)

Disclosures / Credits

This code was written with the help of Cursor and modified by a human (me) before being pushed to this branch.