Support org-level JFrog OIDC credential aliases for npm registry auth

[Copilot]

What are you trying to accomplish?

Repository-level npm JFrog OIDC config worked, but equivalent org-level config failed token exchange (403 FORBIDDEN) and fell through to unauthenticated registry calls (401).
This change makes JFrog OIDC parsing accept org-level key variants so both config sources resolve to the same runtime credential.

• Problem surface
  • Org-level credentials use alternate key names that were not recognized by JFrog OIDC parsing.
• Outcome
  • JFrog OIDC credentials are now built consistently from repo-level and org-level inputs.

Anything you want to highlight for special attention from reviewers?

• Credential key normalization
  • Added first-non-empty resolution for JFrog fields:
    • URL: url or registry
    • Provider: jfrog-oidc-provider-name or oidc-provider-name
    • Audience: audience or oidc-audience
    • Identity mapping: identity-mapping-name, oidc-identity-mapping-name, or jfrog-oidc-identity-mapping-name
• Scope containment
  • Change is isolated to CreateOIDCCredential JFrog parsing; request matching/auth flow remains unchanged.

How will you know you've accomplished your goal?

When org-level aliases are provided, JFrog parameters resolve identically to repo-level fields and the credential is recognized as JFrog OIDC:

config.Credential{
  "registry": "https://jfrog.example.com/artifactory/api/npm/my-feed",
  "oidc-provider-name": "some-provider",
  "oidc-audience": "test-audience",
  "jfrog-oidc-identity-mapping-name": "test-mapping",
}

• Behavioral proof point
  • Added coverage in internal/oidc/oidc_credential_test.go for alias-based JFrog parsing.

End to end test, error recreated here:
https://github.com/dsp-testing/npm-org-level-oidc-testing/actions/runs/34606745479/job/103286925315
https://github.com/thavaahariharangit-org/npm-orglevel-oidc-fr-13771/actions/runs/34583164318/job/103211204246

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

🟢 Approval recommended

No unresolved review issues were identified, and regression coverage was added.

Pull request overview

Adds org-level JFrog OIDC credential alias support for npm registry authentication.

Changes:

• Normalizes JFrog URL, provider, audience, and identity-mapping aliases.
• Adds regression coverage for org-level alias parsing.

File summaries

File	Description
internal/oidc/oidc_credential.go	Resolves supported JFrog credential aliases.
internal/oidc/oidc_credential_test.go	Tests org-level alias parsing.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[kbukum1]

I think this PR is fixing the wrong layer

I traced both credential producers and both failing runs. The evidence says the 403/401 isn't a key-parsing problem, so these aliases won't fix it.

1. The credential already parses correctly

Both linked runs show the proxy recognizing the credential with the current keys:

registered jfrog OIDC credentials for npm registry: https://jfrogghdemo.jfrog.io/...

It arrives with canonical keys (url + registry + replaces-base) — no oidc-* variants.

2. The real failure is downstream, at token exchange

failed to exchange GitHub token for JFrog token: JFrog returned status 403 FORBIDDEN
→ 401 on the registry request

This is JFrog rejecting the exchanged GitHub OIDC token — a trust / provider-name / audience / identity-mapping mismatch on the JFrog side (or in the values we send it), not a key-name mismatch the alias fallback addresses.

3. The added aliases have no producer

Alias	Producer found?
registry	✅ real (npm), but redundant — url is always present too
oidc-provider-name	❌ none (both repos emit jfrog-oidc-provider-name)
oidc-audience	❌ Cloudsmith-only input, normalized to audience before serialization
oidc-identity-mapping-name	❌ none
jfrog-oidc-identity-mapping-name	❌ none

• Org-level (github/github) build_oidc_credential always emits url + jfrog-oidc-provider-name (+ optional audience, identity-mapping-name), confirmed by its own test.
• Repo-level (dependabot-api) Registry#serialized_credentials emits the same canonical keys.

The test fixture here (alias keys, no url) can't be generated by any traced code path.

Suggested next step

Rather than adding key aliases, let's inspect the exchange request itself — the exact provider name, audience, and identity-mapping the proxy sends to JFrog's OIDC token endpoint — and diff it against the JFrog integration/identity-mapping config for jfrogghdemo. That's where the 403 originates.