feat!: install the standalone CLI and authenticate via native OIDC

.circleci/config.yml

@@ -1,67 +1,65 @@
 ---
 version: 2.1
-
-parameters:
-  publish-orb-name:
-    type: string
-    default: cloudsmith/cloudsmith
+setup: true
 
 orbs:
   orb-tools: circleci/orb-tools@12.4.0
+  shellcheck: circleci/shellcheck@3.4.0
 
 # Run jobs on all branches and tags
 filters: &filters
   tags:
     only: /.*/
 
-# Run jobs only on semver release tags (e.g. v2.0.0)
-release-filters: &release-filters
-  branches:
-    ignore: /.*/
-  tags:
-    only: /^v[0-9]+\.[0-9]+\.[0-9]+$/
+jobs:
+  # The installer in src/scripts/install.sh is vendored from
+  # https://github.com/cloudsmith-io/cloudsmith-cli-install-script and must
+  # only change together with src/scripts/install.sh.version.
+  installer-drift-check:
+    docker:
+      - image: cimg/base:current
+    steps:
+      - checkout
+      - run:
+          name: Verify vendored installer matches the recorded checksum
+          command: |
+            expected="$(awk -F= '$1 == "sha256" {print $2}' src/scripts/install.sh.version)"
+            actual="$(sha256sum src/scripts/install.sh | awk '{print $1}')"
+            if [ "$expected" != "$actual" ]; then
+              echo "src/scripts/install.sh does not match src/scripts/install.sh.version" >&2
+              echo "expected sha256: $expected" >&2
+              echo "actual sha256:   $actual" >&2
+              echo "Update both files together when vendoring a new installer release." >&2
+              exit 1
+            fi
+            version="$(awk -F= '$1 == "version" {print $2}' src/scripts/install.sh.version)"
+            echo "Vendored installer (version: $version) matches the recorded checksum."
 
 workflows:
-  lint-pack-publish:
+  lint-pack:
     jobs:
-      # Lint all YAML files in src/
       - orb-tools/lint:
           filters: *filters
-      # Pack src/ into a single orb.yml and validate it
       - orb-tools/pack:
           filters: *filters
-      # Review orb source against CircleCI best practices
       - orb-tools/review:
-          filters: *filters
           orb_name: cloudsmith
-          # RC009: long inline commands (we use inline bash intentionally)
-          # RC010: snake_case naming (our params use kebab-case by convention)
+          # RC009: inline commands are used for trivial steps intentionally
+          # RC010: parameters use kebab-case by convention
           exclude: RC009,RC010
-      # Publish a dev version on every push (except release tags and PRs)
-      - orb-tools/publish:
-          name: publish-dev
-          orb_name: << pipeline.parameters.publish-orb-name >>
-          vcs_type: << pipeline.project.type >>
-          pub_type: dev
-          context: orb-publishing
-          requires:
-            - orb-tools/lint
-            - orb-tools/pack
-            - orb-tools/review
-          filters:
-            branches:
-              ignore: /^pull\/[0-9]+/
-            tags:
-              ignore: /^v[0-9]+\.[0-9]+\.[0-9]+$/
-      # Publish a production version when a semver tag is pushed
-      - orb-tools/publish:
-          name: publish-production
-          orb_name: << pipeline.parameters.publish-orb-name >>
+          filters: *filters
+      - shellcheck/check:
+          filters: *filters
+      - installer-drift-check:
+          filters: *filters
+      - orb-tools/continue:
+          pipeline_number: << pipeline.number >>
           vcs_type: << pipeline.project.type >>
-          pub_type: production
-          context: orb-publishing
+          orb_name: cloudsmith
           requires:
             - orb-tools/lint
             - orb-tools/pack
             - orb-tools/review
-          filters: *release-filters
+            - shellcheck/check
+            - installer-drift-check
+          filters: *filters

.circleci/test-deploy.yml

@@ -0,0 +1,166 @@
+---
+version: 2.1
+
+orbs:
+  # The orb built from src/ is injected here by orb-tools/continue.
+  cloudsmith: {}
+  orb-tools: circleci/orb-tools@12.4.0
+
+parameters:
+  test-organization:
+    type: string
+    default: ""
+    description: Cloudsmith organization used by the OIDC integration test.
+  test-service-account:
+    type: string
+    default: ""
+    description: Cloudsmith service account used by the OIDC integration test.
+
+# Run jobs on all branches and tags
+filters: &filters
+  tags:
+    only: /.*/
+
+# Run jobs only on semver release tags (e.g. v3.0.0)
+release-filters: &release-filters
+  branches:
+    ignore: /.*/
+  tags:
+    only: /^v[0-9]+\.[0-9]+\.[0-9]+$/
+
+executors:
+  linux-docker:
+    docker:
+      - image: cimg/base:current
+  alpine-docker:
+    docker:
+      - image: alpine:3.21
+  linux-machine:
+    machine:
+      image: ubuntu-2404:current
+  macos:
+    macos:
+      xcode: "16.2"
+
+jobs:
+  install-test:
+    parameters:
+      executor:
+        type: executor
+    executor: << parameters.executor >>
+    steps:
+      - run:
+          name: Install job dependencies (Alpine only)
+          shell: /bin/sh
+          command: |
+            if command -v apk > /dev/null 2>&1; then
+              apk add --no-cache bash curl ca-certificates
+            fi
+      - cloudsmith/install-cli
+      - run:
+          name: Verify the CLI is on PATH in later steps
+          command: |
+            command -v cloudsmith
+            cloudsmith --version
+
+  install-pinned-version-test:
+    executor: linux-docker
+    steps:
+      - cloudsmith/install-cli:
+          cli-version: "1.19.2"
+      - run:
+          name: Verify the pinned CLI version was installed
+          command: |
+            cloudsmith --version | grep -Fx "CLI Package Version: 1.19.2"
+
+  api-key-test:
+    executor: linux-docker
+    steps:
+      - run:
+          name: Skip unless CLOUDSMITH_API_KEY is available
+          command: |
+            if [ -z "${CLOUDSMITH_API_KEY:-}" ]; then
+              echo "CLOUDSMITH_API_KEY is not set; skipping the API key test."
+              circleci-agent step halt
+            fi
+      - cloudsmith/ensure-api-key
+      - cloudsmith/install-cli
+      - run:
+          name: Verify API key authentication
+          command: cloudsmith whoami
+
+  oidc-test:
+    executor: linux-docker
+    steps:
+      - run:
+          name: Skip unless OIDC testing is enabled
+          command: |
+            if [ "${CLOUDSMITH_OIDC_TEST:-}" != "true" ]; then
+              echo "CLOUDSMITH_OIDC_TEST is not 'true'; skipping the OIDC test."
+              circleci-agent step halt
+            fi
+            if [ -z "<< pipeline.parameters.test-organization >>" ] || [ -z "<< pipeline.parameters.test-service-account >>" ]; then
+              echo "test-organization/test-service-account pipeline parameters are not set; skipping the OIDC test."
+              circleci-agent step halt
+            fi
+            if [ -z "${CIRCLE_OIDC_TOKEN_V2:-}" ] && [ -z "${CIRCLE_OIDC_TOKEN:-}" ]; then
+              echo "No OIDC token; the job must use a context. Skipping the OIDC test."
+              circleci-agent step halt
+            fi
+      - cloudsmith/install-cli
+      - cloudsmith/configure-oidc:
+          organization: << pipeline.parameters.test-organization >>
+          service-account: << pipeline.parameters.test-service-account >>
+          verify-auth: true
+      - run:
+          name: Verify OIDC configuration persists to later steps
+          command: cloudsmith whoami
+
+workflows:
+  test-deploy:
+    jobs:
+      - install-test:
+          matrix:
+            parameters:
+              executor: [linux-docker, alpine-docker, linux-machine, macos]
+          filters: *filters
+      - install-pinned-version-test:
+          filters: *filters
+      - api-key-test:
+          context: cloudsmith-api-key-test
+          filters: *filters
+      - oidc-test:
+          context: orb-publishing
+          filters: *filters
+      - orb-tools/pack:
+          filters: *filters
+      # Publish a dev version on every push (except forked PRs and release tags)
+      - orb-tools/publish:
+          name: publish-dev
+          orb_name: cloudsmith/cloudsmith
+          vcs_type: << pipeline.project.type >>
+          pub_type: dev
+          context: orb-publishing
+          requires:
+            - orb-tools/pack
+            - install-test
+            - install-pinned-version-test
+            - api-key-test
+            - oidc-test
+          filters:
+            branches:
+              ignore: /^pull\/[0-9]+/
+      # Publish a production version when a semver tag is pushed
+      - orb-tools/publish:
+          name: publish-production
+          orb_name: cloudsmith/cloudsmith
+          vcs_type: << pipeline.project.type >>
+          pub_type: production
+          context: orb-publishing
+          requires:
+            - orb-tools/pack
+            - install-test
+            - install-pinned-version-test
+            - api-key-test
+            - oidc-test
+          filters: *release-filters