添加嵌套 CI 的 SPIRE JWT broker

tests/test_jwt_broker.py

@@ -0,0 +1,16 @@
+import pytest
+
+from gitea_microvm_runner.jwt_broker import extract_svid
+
+
+def test_extract_svid_from_spire_json():
+    assert extract_svid([
+        {"svids": [{"hint": "", "spiffe_id": "spiffe://example/ci", "svid": "jwt"}]},
+        {"bundles": {}},
+    ]) == "jwt"
+
+
+@pytest.mark.parametrize("document", [{}, [], [{"bundles": {}}]])
+def test_extract_svid_rejects_unexpected_response(document):
+    with pytest.raises(ValueError):
+        extract_svid(document)