From a2887ec678508bc74c2892d819d51370768bd9c1 Mon Sep 17 00:00:00 2001 From: Bartosz Blizniak Date: Tue, 21 Jul 2026 16:04:23 +0100 Subject: [PATCH 1/4] feat: publish install scripts to Cloudsmith on release Adds a publish-cloudsmith job to the release workflow that dogfoods install.sh to fetch the Cloudsmith CLI, authenticates via the CLI's native GitHub Actions OIDC exchange, and pushes install.sh, install.ps1, and SHA256SUMS as raw packages. Gated on vars.CLOUDSMITH_SERVICE_SLUG so existing tag runs stay green until the Cloudsmith side is configured. Documents the resulting stable download URLs in the README. --- .github/workflows/release.yml | 69 +++++++++++++++++++++++++++++++++++ CHANGELOG.md | 7 ++++ README.md | 20 ++++++++++ 3 files changed, 96 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 71600bf..b89925e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -230,3 +230,72 @@ jobs: --repo "$TARGET_REPO" \ --title "chore: vendor installer scripts ${TAG}" \ --body "Vendors install.sh/install.ps1 from ${SOURCE_REPO}@${TAG} (commit ${GITHUB_SHA})." + + publish-cloudsmith: + name: Publish to Cloudsmith + needs: release + if: ${{ vars.CLOUDSMITH_SERVICE_SLUG != '' }} + runs-on: ubuntu-latest + permissions: + contents: read + id-token: write # needed for the CLI to exchange the GitHub Actions OIDC token + env: + # Consumed automatically by the CLI's GitHub Actions OIDC exchange. + CLOUDSMITH_ORG: ${{ vars.CLOUDSMITH_NAMESPACE }} + CLOUDSMITH_SERVICE_SLUG: ${{ vars.CLOUDSMITH_SERVICE_SLUG }} + CLOUDSMITH_NAMESPACE: ${{ vars.CLOUDSMITH_NAMESPACE }} + CLOUDSMITH_REPO: ${{ vars.CLOUDSMITH_REPO }} + TAG: ${{ github.ref_name }} + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Install the Cloudsmith CLI using install.sh + run: | + set -eu + output="$(sh ./install.sh --version latest)" + printf '%s\n' "$output" + executable="$(printf '%s\n' "$output" | grep '^executable=' | cut -d= -f2-)" + test -n "$executable" + echo "CLOUDSMITH_BIN=$executable" >> "$GITHUB_ENV" + + - name: Generate SHA256SUMS + run: sha256sum install.sh install.ps1 > SHA256SUMS + + - name: Authenticate via GitHub OIDC + run: | + set -eu + "$CLOUDSMITH_BIN" whoami + + - name: Push install scripts + run: | + set -eu + VERSION="${TAG#v}" + for file in install.sh install.ps1 SHA256SUMS; do + "$CLOUDSMITH_BIN" push raw \ + "$CLOUDSMITH_NAMESPACE/$CLOUDSMITH_REPO" \ + "$file" \ + --name "$file" \ + --version "$VERSION" \ + --republish + done + + - name: Verify published files + run: | + set -eu + VERSION="${TAG#v}" + for file in install.sh install.ps1 SHA256SUMS; do + url="https://dl.cloudsmith.io/public/$CLOUDSMITH_NAMESPACE/$CLOUDSMITH_REPO/raw/names/$file/versions/$VERSION/$file" + expected="$(sha256sum "$file" | awk '{print $1}')" + if ! actual="$(curl -fsSL "$url" | sha256sum | awk '{print $1}')"; then + echo "notice: could not download $url (repository may still be private); skipping verification" + continue + fi + if [ "$expected" != "$actual" ]; then + echo "checksum mismatch for $url" >&2 + exit 1 + fi + echo "verified $url" + done diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ecfe76..5173f22 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Added + +- Release workflow job publishing `install.sh`, `install.ps1`, and + `SHA256SUMS` to Cloudsmith, gated on configuration and authenticated via the + CLI's GitHub Actions OIDC exchange. +- README instructions for installing from the published Cloudsmith URLs. + ## [0.1.0] - 2026-07-16 ### Added diff --git a/README.md b/README.md index 3077482..17f9b0d 100644 --- a/README.md +++ b/README.md @@ -58,6 +58,26 @@ sh ./install.sh --version latest On success, use the reported `bin_dir` to update `PATH`, or invoke the reported `executable` directly. +### Install from Cloudsmith + +Tagged releases are also published to Cloudsmith at stable URLs, defaulting to +`latest`: + +```sh +curl -fsSLO https://dl.cloudsmith.io/public/cloudsmith/cloudsmith-cli-install-script/raw/names/install.sh/versions/latest/install.sh +sh ./install.sh --version latest +``` + +```powershell +Invoke-WebRequest -Uri https://dl.cloudsmith.io/public/cloudsmith/cloudsmith-cli-install-script/raw/names/install.ps1/versions/latest/install.ps1 -OutFile install.ps1 +./install.ps1 -Version latest +``` + +`SHA256SUMS` is published alongside at the same path pattern +(`.../raw/names/SHA256SUMS/versions/latest/SHA256SUMS`) for verification. +Replace `latest` with a tag's version (for example `0.1.0`) to pin a specific +release. + ## How installation works ```mermaid From 8dbb4bd736d53ca4f5554dab98e5325ebef77202 Mon Sep 17 00:00:00 2001 From: Bartosz Blizniak Date: Tue, 21 Jul 2026 16:16:01 +0100 Subject: [PATCH 2/4] feat: publish the scripts as cli.sh and cli.ps1 The Cloudsmith packages are named cli.sh and cli.ps1 so they are served at https://install.cloudsmith.com/cli. once the custom domain is live. SHA256SUMS covers the published names. Co-Authored-By: Claude Fable 5 --- .github/workflows/release.yml | 14 ++++++++++---- CHANGELOG.md | 7 ++++--- README.md | 20 ++++++++++---------- 3 files changed, 24 insertions(+), 17 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b89925e..37d9977 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -261,8 +261,14 @@ jobs: test -n "$executable" echo "CLOUDSMITH_BIN=$executable" >> "$GITHUB_ENV" - - name: Generate SHA256SUMS - run: sha256sum install.sh install.ps1 > SHA256SUMS + # The scripts are published as cli.sh and cli.ps1, served at + # https://install.cloudsmith.com/cli.. + - name: Stage scripts under their published names + run: | + set -eu + cp install.sh cli.sh + cp install.ps1 cli.ps1 + sha256sum cli.sh cli.ps1 > SHA256SUMS - name: Authenticate via GitHub OIDC run: | @@ -273,7 +279,7 @@ jobs: run: | set -eu VERSION="${TAG#v}" - for file in install.sh install.ps1 SHA256SUMS; do + for file in cli.sh cli.ps1 SHA256SUMS; do "$CLOUDSMITH_BIN" push raw \ "$CLOUDSMITH_NAMESPACE/$CLOUDSMITH_REPO" \ "$file" \ @@ -286,7 +292,7 @@ jobs: run: | set -eu VERSION="${TAG#v}" - for file in install.sh install.ps1 SHA256SUMS; do + for file in cli.sh cli.ps1 SHA256SUMS; do url="https://dl.cloudsmith.io/public/$CLOUDSMITH_NAMESPACE/$CLOUDSMITH_REPO/raw/names/$file/versions/$VERSION/$file" expected="$(sha256sum "$file" | awk '{print $1}')" if ! actual="$(curl -fsSL "$url" | sha256sum | awk '{print $1}')"; then diff --git a/CHANGELOG.md b/CHANGELOG.md index 5173f22..279198e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,9 +9,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added -- Release workflow job publishing `install.sh`, `install.ps1`, and - `SHA256SUMS` to Cloudsmith, gated on configuration and authenticated via the - CLI's GitHub Actions OIDC exchange. +- Release workflow job publishing the install scripts to Cloudsmith as + `cli.sh` and `cli.ps1` (with `SHA256SUMS`), gated on configuration and + authenticated via the CLI's GitHub Actions OIDC exchange. Served at + `https://install.cloudsmith.com/cli.`. - README instructions for installing from the published Cloudsmith URLs. ## [0.1.0] - 2026-07-16 diff --git a/README.md b/README.md index 17f9b0d..f006db5 100644 --- a/README.md +++ b/README.md @@ -60,23 +60,23 @@ On success, use the reported `bin_dir` to update `PATH`, or invoke the reported ### Install from Cloudsmith -Tagged releases are also published to Cloudsmith at stable URLs, defaulting to -`latest`: +Tagged releases are also published to Cloudsmith as `cli.sh` and `cli.ps1`, +served at stable short URLs: ```sh -curl -fsSLO https://dl.cloudsmith.io/public/cloudsmith/cloudsmith-cli-install-script/raw/names/install.sh/versions/latest/install.sh -sh ./install.sh --version latest +curl -fsSLO https://install.cloudsmith.com/cli.sh +sh ./cli.sh --version latest ``` ```powershell -Invoke-WebRequest -Uri https://dl.cloudsmith.io/public/cloudsmith/cloudsmith-cli-install-script/raw/names/install.ps1/versions/latest/install.ps1 -OutFile install.ps1 -./install.ps1 -Version latest +Invoke-WebRequest -Uri https://install.cloudsmith.com/cli.ps1 -OutFile cli.ps1 +./cli.ps1 -Version latest ``` -`SHA256SUMS` is published alongside at the same path pattern -(`.../raw/names/SHA256SUMS/versions/latest/SHA256SUMS`) for verification. -Replace `latest` with a tag's version (for example `0.1.0`) to pin a specific -release. +`SHA256SUMS` is published alongside for verification. Pinned versions and the +checksums are available at +`https://dl.cloudsmith.io/public/cloudsmith/cloudsmith-cli-install-script/raw/names//versions//` +where `` is `cli.sh`, `cli.ps1`, or `SHA256SUMS`. ## How installation works From b5ba43f98d32e70716039a6e48d4ce1bbcc9cff3 Mon Sep 17 00:00:00 2001 From: Bartosz Blizniak Date: Tue, 21 Jul 2026 16:30:16 +0100 Subject: [PATCH 3/4] docs: install with a single piped command Co-Authored-By: Claude Fable 5 --- README.md | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index f006db5..f11c926 100644 --- a/README.md +++ b/README.md @@ -61,22 +61,25 @@ On success, use the reported `bin_dir` to update `PATH`, or invoke the reported ### Install from Cloudsmith Tagged releases are also published to Cloudsmith as `cli.sh` and `cli.ps1`, -served at stable short URLs: +served at stable short URLs. Install the latest CLI with one command: ```sh -curl -fsSLO https://install.cloudsmith.com/cli.sh -sh ./cli.sh --version latest +curl -fsSL https://install.cloudsmith.com/cli.sh | sh ``` ```powershell -Invoke-WebRequest -Uri https://install.cloudsmith.com/cli.ps1 -OutFile cli.ps1 -./cli.ps1 -Version latest +irm https://install.cloudsmith.com/cli.ps1 | iex ``` -`SHA256SUMS` is published alongside for verification. Pinned versions and the -checksums are available at +Both scripts install the latest CLI version by default and print the +installed `bin_dir` to add to `PATH`. + +To verify before running, or to pin a version, download the script and +`SHA256SUMS` from `https://dl.cloudsmith.io/public/cloudsmith/cloudsmith-cli-install-script/raw/names//versions//` -where `` is `cli.sh`, `cli.ps1`, or `SHA256SUMS`. +where `` is `cli.sh`, `cli.ps1`, or `SHA256SUMS`, then run it with +`--version X.Y.Z` (`-Version X.Y.Z` in PowerShell). Use pinned, verified +downloads in CI. ## How installation works From cf46494e803990a563c9e193a9a929a0edd3296c Mon Sep 17 00:00:00 2001 From: Bartosz Blizniak Date: Tue, 21 Jul 2026 16:49:45 +0100 Subject: [PATCH 4/4] docs: use the raw/files path on the install domain Co-Authored-By: Claude Fable 5 --- .github/workflows/release.yml | 2 +- CHANGELOG.md | 2 +- README.md | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 37d9977..2ff263e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -262,7 +262,7 @@ jobs: echo "CLOUDSMITH_BIN=$executable" >> "$GITHUB_ENV" # The scripts are published as cli.sh and cli.ps1, served at - # https://install.cloudsmith.com/cli.. + # https://install.cloudsmith.com/raw/files/cli.. - name: Stage scripts under their published names run: | set -eu diff --git a/CHANGELOG.md b/CHANGELOG.md index 279198e..f132895 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,7 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Release workflow job publishing the install scripts to Cloudsmith as `cli.sh` and `cli.ps1` (with `SHA256SUMS`), gated on configuration and authenticated via the CLI's GitHub Actions OIDC exchange. Served at - `https://install.cloudsmith.com/cli.`. + `https://install.cloudsmith.com/raw/files/cli.`. - README instructions for installing from the published Cloudsmith URLs. ## [0.1.0] - 2026-07-16 diff --git a/README.md b/README.md index f11c926..fc037a2 100644 --- a/README.md +++ b/README.md @@ -64,11 +64,11 @@ Tagged releases are also published to Cloudsmith as `cli.sh` and `cli.ps1`, served at stable short URLs. Install the latest CLI with one command: ```sh -curl -fsSL https://install.cloudsmith.com/cli.sh | sh +curl -fsSL https://install.cloudsmith.com/raw/files/cli.sh | sh ``` ```powershell -irm https://install.cloudsmith.com/cli.ps1 | iex +irm https://install.cloudsmith.com/raw/files/cli.ps1 | iex ``` Both scripts install the latest CLI version by default and print the