chore(ENG-12048): deprecate v1 — Node 20 EoL

[BartoszBlizniak]

Summary

Following the Node.js release cycle, Node 20 is now EoL — this change adds deprecation notices to @v1. We will continue to provide security-only patches until 2026-12-31, after which @v1 reaches end-of-life. This window is to allow time for migration to @v2.

Where the deprecation surfaces

• Runtime annotation in the GitHub Actions UI on every @v1 job (via core.warning)
• Banner at the top of the @v1 README
• [DEPRECATED] prefix on the action.yml description (visible in the Marketplace listing)
• New CHANGELOG.md entry on release/v1 (1.0.11)

Migrating from @v1 → @v2

1. Bump the action reference

- uses: cloudsmith-io/cloudsmith-cli-action@v1
+ uses: cloudsmith-io/cloudsmith-cli-action@v2

2. OIDC audience default has changed

@v2 now defaults oidc-audience to https://github.com/{org-name} (resolved from GITHUB_REPOSITORY_OWNER) instead of api://AzureADTokenExchange.

If your downstream validates the aud claim against the old value, either update that validation or pin the previous default explicitly:

with:
  oidc-audience: 'api://AzureADTokenExchange'

3. Self-hosted runners need Node.js 24

GitHub-hosted runners are unaffected. Self-hosted runners must provide Node.js 24+.

No input or output names changed — existing workflows otherwise migrate one-for-one.

[Copilot]

Pull request overview

• Adds explicit deprecation messaging for the @v1 GitHub Action now that it runs on an EoL Node.js runtime, and guides users toward migrating to @v2.

Changes:

• Emit a runtime deprecation warning on every @v1 run via core.warning.
• Add deprecation notices in user-facing metadata/docs (README banner, Marketplace description, changelog entry).
• Bump the @v1 package version to 1.0.11 and regenerate the bundled dist/index.js.

Reviewed changes

Copilot reviewed 5 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/main.js	Adds a runtime core.warning deprecation notice for @v1.
README.md	Adds a top-of-file deprecation banner and migration pointers to @v2.
action.yml	Prefixes the Marketplace description to indicate @v1 is deprecated.
CHANGELOG.md	Introduces a changelog entry documenting the deprecation in 1.0.11.
package.json	Bumps the package version to 1.0.11.
package-lock.json	Updates lock metadata to match the new version.
dist/index.js	Regenerates the bundled action with the new deprecation warning included.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.