Function resolveOidcTokenForBuild

packages/container/src/oidc.ts:93–145

(span?: Span)

 * fails, we fall back to the existing token rather than failing the build.
 */
export async function resolveOidcTokenForBuild(span?: Span): Promise<string> {
  const existing = readString(process.env.VERCEL_OIDC_TOKEN);
  if (!existing) {
    throw new Error(
      'Missing VERCEL_OIDC_TOKEN for the container registry ' +
        '(set by the platform or `vercel pull`).'
    );
  }

  // A user/CLI auth token is the only credential that can mint a fresh project
  // OIDC token. Without it, the existing token is the best we have.
  const authToken = readString(process.env.VERCEL_TOKEN);
  if (!authToken) {
    debug(
      'No VERCEL_TOKEN available to mint; using existing VERCEL_OIDC_TOKEN'
    );
    span?.setAttributes({ 'oidc.mint_result': 'reused_existing' });
    debug(`registry token: ${tokenFingerprint(existing)}`);
    return existing;
  }

  const { projectId, teamId } = resolveProjectContext(existing);
  if (!projectId) {
    debug('No project id available to mint; using existing VERCEL_OIDC_TOKEN');
    span?.setAttributes({ 'oidc.mint_result': 'reused_existing' });
    return existing;
  }

  step('Minting fresh OIDC token for container registry');
  let token: string;
  try {
    token = await mintProjectOidcToken({
      projectId,
      teamId,
      authToken,
    });
  } catch (err) {
    // Minting is an optimization; fall back to the existing token.
    debug(`OIDC mint failed, using existing token: ${(err as Error).message}`);
    span?.setAttributes({ 'oidc.mint_result': 'failed_reused_existing' });
    return existing;
  }

  process.env.VERCEL_OIDC_TOKEN = token;
  span?.setAttributes({
    'oidc.mint_result': 'minted',
    'project.id': projectId,
    ...(teamId ? { 'team.id': teamId } : {}),
  });
  done('OIDC token minted');
  debug(`registry token: ${tokenFingerprint(token)}`);
  return token;
}

export function formatVcrAuthError(
  registry: string,