Summary

Add two non-breaking OIDC paths to bundle --attest so it works on headless hosts: --identity-token (with COSIGN_IDENTITY_TOKEN env) for pre-fetched tokens, and --oidc-device-flow (with AICR_OIDC_DEVICE_FLOW env) for the OAuth 2.0 Device Authorization Grant.

Motivation / Context

Today bundle --attest resolves OIDC via exactly two paths: ambient GitHub Actions credentials, or an interactive browser callback bound to localhost:<random-port>. The interactive flow is unusable on remote build boxes, bastions, or air-gapped runners — the OIDC provider redirects to localhost on the laptop where the user logs in, never on the host running aicr. Existing workarounds (SSH port-forwarding the random callback port, or running aicr on the laptop) are gymnastics.

This change introduces two cosign-aligned, non-breaking auth paths so
attestation is reachable on any host. Selection precedence:

1. --identity-token / COSIGN_IDENTITY_TOKEN
2. Ambient GitHub Actions OIDC
3. --oidc-device-flow / AICR_OIDC_DEVICE_FLOW
4. Interactive browser (default)

Closes: #682
Related: N/A

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Build/CI/tooling

Component(s) Affected

• CLI (cmd/aicr, pkg/cli)
• API server (cmd/aicrd, pkg/api, pkg/server)
• Recipe engine / data (pkg/recipe)
• Bundlers (pkg/bundler, pkg/component/*)
• Collectors / snapshotter (pkg/collector, pkg/snapshotter)
• Validator (pkg/validator)
• Core libraries (pkg/errors, pkg/k8s)
• Docs/examples (docs/, examples/)
• Other: chainsaw e2e (tests/chainsaw/cli/bundle-headless-oidc-ci/)

Implementation Notes

pkg/bundler/attestation/oidc.go

• New FetchDeviceCodeOIDCToken wraps sigstore's already-vendored NewDeviceFlowTokenGetterForIssuer (RFC 8628). User sees a verification URL plus short code on stdout — fully headless.
• Extract shared oauthflow.OIDConnect-with-context-deadline logic into runOIDCConnect. Both FetchInteractiveOIDCToken and the new device-code helper share the same goroutine/select shape.

pkg/cli/bundle.go

• Add --identity-token (StringFlag, Sources: cli.EnvVars("COSIGN_IDENTITY_TOKEN")).
• Add --oidc-device-flow (BoolFlag, Sources: cli.EnvVars("AICR_OIDC_DEVICE_FLOW")).
• Refactor selectAttester to take *bundleCmdOptions and walk the four-tier precedence above.

Flag naming. --oidc-device-flow (not --headless) names the mechanism, not the use case. Two paths in this PR are both headless — calling either of them --headless would create ambiguity. The --oidc-* namespace also matches cosign and leaves room for future --oidc-issuer / --oidc-client-id.

Testing

# Commands run (prefer `make qualify` for non-trivial changes)
make qualify

Risk Assessment

• Low — Isolated change, well-tested, easy to revert
• Medium — Touches multiple components or has broader impact
• High — Breaking change, affects critical paths, or complex rollout

Rollout notes:

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S) — GPG signing info