feat(eng-12917): rebuild as a composite action around the standalone CLI installer

[BartoszBlizniak]

Description

This PR introduces the v3 Cloudsmith CLI Setup Action. The action now installs the standalone Cloudsmith CLI through a composite action, removing the need for Python or Node.js on the runner while retaining API-key and OIDC authentication.

Area	What changes
Installation	Installs the standalone CLI on Linux, macOS, and Windows, with ARM64 support where available
Authentication	Configures API-key or CLI-native OIDC authentication for later workflow steps
Configuration	Adds CLI version selection, a configurable installation directory, and optional authentication verification
Outputs	Exposes the resolved CLI version, target, executable path, and binary directory
Documentation	Adds streamlined examples and a complete v2-to-v3 migration guide

Note

Existing workflows can continue using api-key, or the oidc-namespace and oidc-service-slug pair. The default OIDC audience also remains unchanged.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Breaking Changes

Important

Version 3 installs the standalone CLI instead of the Python package. Workflows using any of the removed inputs or outputs below must be updated before moving from v2 to v3.

Removed v2 option	Migration
pip-install	Remove it. Version 3 always installs the standalone CLI binary.
oidc-auth-only	Remove it. OIDC authentication is now handled by the installed CLI.
oidc-auth-retry	Remove it. The CLI manages token exchange and retries.
oidc-token-validate	Replace it with verify-auth: "true" to validate authentication during setup.
executable-path	Use install-directory to choose the installation root, or read the cli-path output.
oidc-token output	Removed. The action no longer receives or exposes the Cloudsmith access token.

Additional behaviour changes:

• With OIDC, the CLI exchanges credentials on its first authenticated command rather than during the setup action.
• API host, proxy, SSL verification, and user-agent settings are exported as CLOUDSMITH_* environment variables instead of being written to a configuration file.

Additional Notes

The action has been validated with installation, authentication, and input-validation coverage across the supported GitHub-hosted runner platforms.

Tip

See the v2-to-v3 migration guide for complete upgrade examples and configuration details.

[Copilot]

Pull request overview

• Refactors the action from a Node.js-based implementation into a composite action that installs the standalone Cloudsmith CLI via vendored installer scripts, and configures authentication for downstream workflow steps.

Changes:

• Replace Node/JavaScript action runtime with a composite action that runs platform-specific setup scripts (bash / PowerShell).
• Add vendored standalone CLI installers (POSIX + Windows) and CI checks for installer drift/linting.
• Update docs (README, CONTRIBUTION, CHANGELOG) and workflows (test, release, zizmor) to reflect v3 behavior and migration.

Reviewed changes

Copilot reviewed 22 out of 26 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/oidc-auth.js	Removed legacy JS-based OIDC token exchange implementation.
src/main.js	Removed legacy Node entrypoint that orchestrated auth + install.
src/download-cli.js	Removed legacy Python zipapp/pip installer logic.
src/create-config-file.js	Removed legacy config file writer (now uses env vars).
scripts/setup.sh	New POSIX setup wrapper: runs installer, exports env vars/outputs, optional auth verification.
scripts/setup.ps1	New Windows setup wrapper: runs installer, exports env vars/outputs, optional auth verification.
README.md	Rewritten documentation for v3 composite action, outputs, and v2→v3 migration.
package.json	Removed Node packaging metadata (no longer a Node action).
package-lock.json	Removed lockfile (no longer a Node action).
installer/VERSION	Added installer version marker for vendoring provenance.
installer/SHA256SUMS	Added checksums to detect installer drift/tampering in CI.
installer/install.sh	New POSIX standalone CLI installer with manifest + checksum verification and safe extraction checks.
installer/install.ps1	New Windows standalone CLI installer with manifest + checksum verification and safe extraction checks.
eslint.config.js	Removed JS lint config (Node runtime removed).
dist/101.index.js	Removed bundled Node distribution artifact.
CONTRIBUTION.md	Updated contribution guide for composite action + linting + vendored installer policy.
CHANGELOG.md	Documented v3 breaking changes, new inputs/outputs, and behavior changes.
action.yml	Converted to composite action; added new inputs/outputs wiring to setup scripts.
.npmrc	Removed npm registry config (no longer relevant).
.husky/pre-commit	Removed Node build hook (no longer producing dist bundles).
.gitignore	Removed Node-specific ignores (e.g., node_modules).
.github/workflows/zizmor.yml	Added zizmor workflow for action/workflow security scanning.
.github/workflows/test.yml	Added comprehensive lint + install + validation + auth-gated integration tests.
.github/workflows/test_install.yml	Removed legacy Node-based test workflow.
.github/workflows/release.yml	Updated release workflow to use gh and safer permissions/concurrency settings.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.