feat: publish install scripts to Cloudsmith on release

[BartoszBlizniak]

Summary

• Adds a publish-cloudsmith job to .github/workflows/release.yml that runs after the release job on the same tag trigger.
• Gated on vars.CLOUDSMITH_SERVICE_SLUG != '' so existing tag runs stay green until the Cloudsmith side is configured (mirrors the vendor job's vars.ENABLE_VENDORING gate).
• Installs the Cloudsmith CLI by running this repo's own install.sh --version latest (dogfooding) and parses the executable= line from its output without eval.
• Authenticates via the CLI's native GitHub Actions OIDC exchange (id-token: write, CLOUDSMITH_ORG/CLOUDSMITH_SERVICE_SLUG env) — no API key needed.
• Pushes install.sh, install.ps1, and a freshly generated SHA256SUMS as raw packages to ${{ vars.CLOUDSMITH_NAMESPACE }}/${{ vars.CLOUDSMITH_REPO }}, tagged with the release version, using --republish so re-running a tag is idempotent.
• Verifies each pushed file by downloading it from the public dl.cloudsmith.io URL and comparing checksums; a failed download (e.g. repo still private) prints a notice and is skipped rather than failing the job, but a checksum mismatch on a successful download still fails.
• Adds an "Install from Cloudsmith" subsection to the README documenting the stable download URLs (defaulting to latest) for both install.sh and install.ps1, plus SHA256SUMS. Existing GitHub-releases instructions are unchanged.
• Adds a CHANGELOG entry under [Unreleased].

Required configuration before merging

• Set repository variable CLOUDSMITH_NAMESPACE=cloudsmith
• Set repository variable CLOUDSMITH_REPO=cloudsmith-cli-install-script
• Set repository variable CLOUDSMITH_SERVICE_SLUG=cli-install-script-publisher
• Configure the Cloudsmith OIDC provider mapping: GitHub Actions issuer, claim repo:cloudsmith-io/cloudsmith-cli-install-script:* → service account cli-install-script-publisher
• Make the cloudsmith/cloudsmith-cli-install-script Cloudsmith repository public before the dl.cloudsmith.io public download URLs in the README will work

Validation

• sh -n install.sh and shellcheck --shell=sh --severity=style install.sh (unchanged, still clean)
• bats tests/install.bats — 39/39 passing
• shellcheck --shell=bash --severity=style against each new workflow run: block — clean
• zizmor --pedantic .github/workflows/release.yml — no findings

Compatibility

None. No change to the installer scripts, their options, environment variables, installation paths, or the four-line output contract.

Checklist

• I have added or updated tests where appropriate. (No installer behavior changed; existing bats suite still passes.)
• I have updated documentation and CHANGELOG.md where appropriate.
• I have not included credentials, tokens, or other sensitive data.
• I have called out any breaking change explicitly. (None.)

[wiz-bf9f52b9c0]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	1
SAST Findings	-
Software Management Findings	-
Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[Copilot]

Pull request overview

Publishes this repository’s installer artifacts to Cloudsmith on tagged releases, so users can install via stable Cloudsmith “short URLs” while keeping existing GitHub Releases instructions intact.

Changes:

• Adds a publish-cloudsmith job to the release workflow to push cli.sh, cli.ps1, and SHA256SUMS as Cloudsmith raw packages using GitHub Actions OIDC.
• Documents Cloudsmith install/download URLs in README.md.
• Records the new publishing behavior in CHANGELOG.md under [Unreleased].

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/release.yml	Adds a gated Cloudsmith publish+verify job to the release workflow.
README.md	Adds “Install from Cloudsmith” instructions and stable URL patterns.
CHANGELOG.md	Notes the new Cloudsmith publishing workflow and README update.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.