cooper-oai 96c8be200c Integrate workload identity with Codex authentication (#38188) ...

## What changed

- Select workload identity authentication from `OPENAI_FEDERATION_RULE_ID` and
  `OPENAI_IDENTITY_TOKEN_FILE`, while preserving explicit API key and access
  token precedence.
- Adapt workload identity exchanges to the shared authentication manager and
  reuse a compatible process-scoped session for token resolution and refresh.
- Reject incomplete, conflicting, or unsupported configurations and exchanged
  tokens that change the authenticated subject.
- Classify exchange failures for authentication retry handling and invalidate
  rejected cached tokens without discarding a newer concurrent exchange.

## Testing

- Cover configuration selection and validation, session reuse and conflicts,
  identity-preserving refreshes, concurrent refreshes, and retry classification.

GitOrigin-RevId: 62afb514b4e0a59effb08f464ac929633462a71b

2026-08-12 13:27:57 +00:00

..

src

Integrate workload identity with Codex authentication (#38188)

2026-08-12 13:27:57 +00:00

BUILD.bazel

…

Cargo.toml

…