Default Setup: GCP OIDC private registry (Artifact Registry, Maven) registered but requests sent unauthenticated (401) #4229

Summary

Default Setup (Code Quality and code scanning, Java, build-mode: none) with an organization-level maven_repository private registry on Google Artifact Registry using GCP OIDC (auth_type: oidc_gcp, direct Workload Identity Federation, no service account). The proxy registers the credentials and the token exchange succeeds, but requests to the registry are sent without credentials, so every artifact returns 401. This looks like the GCP equivalent of #3838, after GCP OIDC configurations started being accepted in #3850.

Environment

What happens

1. "Setup proxy for registries" lists the registry with the GCP Workload Identity Provider, and proxy.log shows:
   registered gcp OIDC credentials for maven repository: https://<region>-maven.pkg.dev/<project>/<repo>
2. Google STS logs show a successful token exchange for the job's OIDC subject (repo:<org>/<repo>:ref:refs/pull/<n>/head) right after the proxy starts.
3. Every artifact request through the proxy then gets 401:
   [014] 401 https://<region>-maven.pkg.dev:443/<project>/<repo>/com/fasterxml/.../x.jar
Remote response: {"error":"Unauthenticated request. Unauthenticated requests do not have permission \"artifactregistry.repositories.downloadArtifacts\" ..."}
   Artifact Registry audit logs show these requests with empty authenticationInfo (anonymous).
4. The proxy then falls back to repo.maven.apache.org for each artifact despite replaces_base: true.

Why we think the token is fine

• The same Workload Identity provider and IAM binding (principalSet://.../attribute.repository_owner/<org>, roles/artifactregistry.reader) authenticate normal workflows to the same Maven repository (federated token as oauth2accesstoken password): requests appear with the federated principal and succeed.
• If we write our own Maven settings.xml with that federated token, Maven's requests go through the CodeQL proxy and succeed (200). Only requests that rely on the proxy to add credentials fail: the dependency fetches made by the Java extractor in build-mode: none.
• Possibly relevant: the proxy logs request URLs with an explicit port (https://<host>:443/...) while the credentials are registered for https://<host>/....

Expected

The proxy attaches the federated access token (e.g. Basic oauth2accesstoken:<token>) to requests matching the registry URL, as it does for the OIDC providers fixed in #3838, and does not fall back to Maven Central when replaces_base is true.

Happy to share full proxy logs privately.