feat: export CLI-resolved authentication token

[BartoszBlizniak]

Description

Adds an opt-in export-auth-token input that resolves the effective Cloudsmith credential through cloudsmith credential-helper generic.

The action invokes the helper once, validates its version-1 JSON response, masks the credential, and exports:

• .password as CLOUDSMITH_API_KEY;
• .username as CLOUDSMITH_USERNAME (the package-client value token); and
• .password through the existing oidc-token output for compatibility.

The deprecated oidc-auth-only input is retained as an alias for export-auth-token. When it is set to true, it enables the same credential-export flow and emits a deprecation warning. The default lazy OIDC behavior remains unchanged when neither input is enabled.

This allows later workflow steps and third-party package clients to reuse the CLI-resolved credential without parsing the helper response themselves.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

• Requires Cloudsmith CLI 1.21.0 or later when credential export is enabled.
• Linux and macOS runners require jq when credential export is enabled. GitHub-hosted runners already provide it; self-hosted runners must make it available on PATH.
• The password is masked before it is written to the job environment or action output.
• Invalid, unsupported, empty, or multiline credential-helper responses fail the setup step.
• API-key authentication remains supported and unchanged.

Validation

Static validation passed:

• Bash syntax and ShellCheck
• PowerShell AST parsing and PSScriptAnalyzer
• actionlint
• git diff --check

A live private-repository workflow tested this PR's head commit with Cloudsmith CLI v1.21.0:

• unchanged lazy OIDC behavior on Ubuntu;
• export-auth-token: "true" on Ubuntu and macOS;
• deprecated oidc-auth-only: "true" on Ubuntu and Windows; and
• the existing api-key input on Ubuntu.

All six jobs passed. The tests verified successful authentication, exact CLI version, matching CLOUDSMITH_API_KEY/CLOUDSMITH_USERNAME/output values, the expected deprecation warning, and that no raw credential JSON or unmasked token appeared in the logs.

Test run: https://github.com/BartoszBlizniak/github-actions-demo/actions/runs/30825267945

[Copilot]

Pull request overview

Adds an opt-in pathway for workflows to retrieve and export the Cloudsmith authentication token resolved by the CLI (useful for tooling that expects a raw token, e.g., npm/pip/docker login), while keeping the default behavior of not exposing tokens.

Changes:

• Adds export-auth-token input (plus deprecated oidc-auth-only alias) and wires them through the composite action.
• Updates setup scripts to run cloudsmith tokens show, mask the token, export it as CLOUDSMITH_API_KEY, and expose it as the oidc-token output.
• Updates documentation and changelog to describe the new behavior and migration guidance.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
scripts/setup.sh	Adds input parsing for token-export flags and exports CLI-resolved token to env/output.
scripts/setup.ps1	Windows equivalent of token export and output wiring.
action.yml	Declares new inputs and adds oidc-token output, passing inputs to scripts.
README.md	Documents export-auth-token, oidc-token output, and deprecation/migration notes.
CHANGELOG.md	Records the new 3.1.0 release entry describing token export.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (3)

scripts/setup.sh:78

• The deprecation warning for 'oidc-auth-only' doesn't mention that it implicitly enables token export (setting CLOUDSMITH_API_KEY/CLOUDSMITH_USERNAME and writing the 'oidc-token' output). This could surprise users and lead to unintended credential exposure in later steps.

if [[ "$oidc_auth_only" == "true" ]]; then
  echo "::warning::The 'oidc-auth-only' input is deprecated; use 'export-auth-token'. Both resolve credentials through 'cloudsmith credential-helper generic'."
  export_auth_token="true"

scripts/setup.ps1:64

• The deprecation warning for 'oidc-auth-only' doesn't mention that it implicitly enables token export (setting CLOUDSMITH_API_KEY/CLOUDSMITH_USERNAME and writing the 'oidc-token' output). This could surprise users and lead to unintended credential exposure in later steps.

if ($oidcAuthOnly -eq 'true') {
  Write-Host "::warning::The 'oidc-auth-only' input is deprecated; use 'export-auth-token'. Both resolve credentials through 'cloudsmith credential-helper generic'."
  $exportAuthToken = 'true'
}

action.yml:56

• The PR description says the token is resolved via cloudsmith tokens show, but the implementation and input description here use cloudsmith credential-helper generic. Please align the PR description (or the implementation) so reviewers/users aren't misled about which CLI command is used.

  export-auth-token:
    description: "Resolve credentials with 'cloudsmith credential-helper generic', then export its password as CLOUDSMITH_API_KEY and username as CLOUDSMITH_USERNAME. Requires Cloudsmith CLI 1.21.0 or later."
    required: false