feat(eng-12917): rebuild as a composite action around the standalone CLI installer#41
Open
BartoszBlizniak wants to merge 1 commit into
Open
feat(eng-12917): rebuild as a composite action around the standalone CLI installer#41BartoszBlizniak wants to merge 1 commit into
BartoszBlizniak wants to merge 1 commit into
Conversation
BartoszBlizniak
force-pushed
the
eng-12917-update-github-actions-integration
branch
from
35bdb18 to
9c2c8dd
Compare
BartoszBlizniak
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
- Refactors the action from a Node.js-based implementation into a composite action that installs the standalone Cloudsmith CLI via vendored installer scripts, and configures authentication for downstream workflow steps.
Changes:
- Replace Node/JavaScript action runtime with a composite action that runs platform-specific setup scripts (bash / PowerShell).
- Add vendored standalone CLI installers (POSIX + Windows) and CI checks for installer drift/linting.
- Update docs (README, CONTRIBUTION, CHANGELOG) and workflows (test, release, zizmor) to reflect v3 behavior and migration.
Reviewed changes
Copilot reviewed 22 out of 26 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
src/oidc-auth.js |
Removed legacy JS-based OIDC token exchange implementation. |
src/main.js |
Removed legacy Node entrypoint that orchestrated auth + install. |
src/download-cli.js |
Removed legacy Python zipapp/pip installer logic. |
src/create-config-file.js |
Removed legacy config file writer (now uses env vars). |
scripts/setup.sh |
New POSIX setup wrapper: runs installer, exports env vars/outputs, optional auth verification. |
scripts/setup.ps1 |
New Windows setup wrapper: runs installer, exports env vars/outputs, optional auth verification. |
README.md |
Rewritten documentation for v3 composite action, outputs, and v2→v3 migration. |
package.json |
Removed Node packaging metadata (no longer a Node action). |
package-lock.json |
Removed lockfile (no longer a Node action). |
installer/VERSION |
Added installer version marker for vendoring provenance. |
installer/SHA256SUMS |
Added checksums to detect installer drift/tampering in CI. |
installer/install.sh |
New POSIX standalone CLI installer with manifest + checksum verification and safe extraction checks. |
installer/install.ps1 |
New Windows standalone CLI installer with manifest + checksum verification and safe extraction checks. |
eslint.config.js |
Removed JS lint config (Node runtime removed). |
dist/101.index.js |
Removed bundled Node distribution artifact. |
CONTRIBUTION.md |
Updated contribution guide for composite action + linting + vendored installer policy. |
CHANGELOG.md |
Documented v3 breaking changes, new inputs/outputs, and behavior changes. |
action.yml |
Converted to composite action; added new inputs/outputs wiring to setup scripts. |
.npmrc |
Removed npm registry config (no longer relevant). |
.husky/pre-commit |
Removed Node build hook (no longer producing dist bundles). |
.gitignore |
Removed Node-specific ignores (e.g., node_modules). |
.github/workflows/zizmor.yml |
Added zizmor workflow for action/workflow security scanning. |
.github/workflows/test.yml |
Added comprehensive lint + install + validation + auth-gated integration tests. |
.github/workflows/test_install.yml |
Removed legacy Node-based test workflow. |
.github/workflows/release.yml |
Updated release workflow to use gh and safer permissions/concurrency settings. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR introduces the v3 Cloudsmith CLI Setup Action. The action now installs the standalone Cloudsmith CLI through a composite action, removing the need for Python or Node.js on the runner while retaining API-key and OIDC authentication.
Note
Existing workflows can continue using
api-key, or theoidc-namespaceandoidc-service-slugpair. The default OIDC audience also remains unchanged.Type of Change
Breaking Changes
Important
Version 3 installs the standalone CLI instead of the Python package. Workflows using any of the removed inputs or outputs below must be updated before moving from v2 to v3.
pip-installoidc-auth-onlyoidc-auth-retryoidc-token-validateverify-auth: "true"to validate authentication during setup.executable-pathinstall-directoryto choose the installation root, or read thecli-pathoutput.oidc-tokenoutputAdditional behaviour changes:
CLOUDSMITH_*environment variables instead of being written to a configuration file.Additional Notes
The action has been validated with installation, authentication, and input-validation coverage across the supported GitHub-hosted runner platforms.
Tip
See the v2-to-v3 migration guide for complete upgrade examples and configuration details.