fix(cli): fall back to federated auth when stored user token is expired

Signed-off-by: Matías Insaurralde <matias@chainloop.dev>

Author: matiasinsaurralde

app/cli/cmd/root.go

@@ -121,8 +121,11 @@ func NewRootCmd(l zerolog.Logger) *cobra.Command {
 				return err
 			}
 
-			// If the auth token is not set and the command supports federated auth, we try to discover the runner and use the federated token for the runner if available
-			if authToken == "" && cmdSupportsFederatedAuth(cmd) {
+			// If the auth token is not set (or it's an expired stored user token) and the command supports federated
+			// auth, we try to discover the runner and use the federated token if available.
+			// The isUserToken guard ensures we only fall through for implicitly loaded config tokens, not for
+			// explicit API tokens provided via flag or CHAINLOOP_TOKEN env var.
+			if (authToken == "" || (isUserToken && token.IsExpired(authToken))) && cmdSupportsFederatedAuth(cmd) {
 				r := crafter.DiscoverRunner(authToken, logger)
 				if r.IsAuthenticated() && r.FederatedToken() != "" {
 					logger.Debug().Str("runner", r.ID().String()).Msg("using federated auth token")

app/cli/internal/token/token.go

@@ -16,6 +16,8 @@
 package token
 
 import (
+	"time"
+
 	v1 "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
 	"github.com/golang-jwt/jwt/v4"
 )
@@ -129,3 +131,26 @@ func Parse(token string) (*ParsedToken, error) {
 
 	return pToken, nil
 }
+
+// IsExpired returns true if the token has an exp claim that is in the past.
+// Returns false for tokens with no exp claim or tokens that cannot be parsed.
+func IsExpired(tokenStr string) bool {
+	if tokenStr == "" {
+		return false
+	}
+
+	parser := jwt.NewParser(jwt.WithoutClaimsValidation())
+	t, _, err := parser.ParseUnverified(tokenStr, jwt.MapClaims{})
+	if err != nil {
+		return false
+	}
+
+	claims, ok := t.Claims.(jwt.MapClaims)
+	if !ok {
+		return false
+	}
+
+	// VerifyExpiresAt returns false when the token is expired.
+	// With req=false, tokens without an exp claim are considered not expired.
+	return !claims.VerifyExpiresAt(time.Now().Unix(), false)
+}

pkg/attestation/crafter/runners/oidc/github.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2025 The Chainloop Authors.
+// Copyright 2025-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -169,7 +169,7 @@ func (c *GitHubOIDCClient) Token(ctx context.Context) (any, error) {
 		return nil, fmt.Errorf("error verifying token: %w", err)
 	}
 
-	token, err := c.decodeToken(t)
+	token, err := c.decodeToken(t, tokenPayload)
 	if err != nil {
 		return nil, fmt.Errorf("error decoding token: %w", err)
 	}
@@ -262,13 +262,14 @@ func (c *GitHubOIDCClient) verifyToken(ctx context.Context, audience []string, a
 	return idToken, nil
 }
 
-func (c *GitHubOIDCClient) decodeToken(token *oidc.IDToken) (*Token, error) {
+func (c *GitHubOIDCClient) decodeToken(token *oidc.IDToken, rawToken string) (*Token, error) {
 	c.logger.Debug().Msgf("decoding token: %s", token)
 	var t Token
 	if err := token.Claims(&t); err != nil {
 		return nil, fmt.Errorf("%w: getting claims: %w", errToken, err)
 	}
 
+	t.RawToken = rawToken
 	return &t, nil
 }