Merged open-source contribution · Recruiters and engineering clients
Cloudsmith CLI Action — API-key and OIDC permission correction
Fixed a cross-platform authentication guard that wrongly required GitHub OIDC permission when an explicit API key took precedence. Added Bash and PowerShell regressions; merged after maintainer approval.
Contribution by Ayobami Haastrup · Merged
The problem
When api-key was supplied together with optional OIDC configuration, scripts/setup.sh and scripts/setup.ps1 still required ACTIONS_ID_TOKEN_REQUEST_URL. The selected API-key path did not need a GitHub ID token, so valid workflows could fail or unnecessarily grant id-token: write permission.
My contribution
- Changed the Bash and PowerShell setup guards to require the ID-token request environment only when OIDC is the effective authentication method (OIDC inputs present without an API key).
- Added regression coverage for explicit API-key precedence with optional OIDC inputs and no ID token, plus a negative control proving OIDC-only authentication still rejects a missing token.
- Preserved API-key precedence and OIDC security requirements without changing installer, API, credential format or release logic.
Upstream maintainer review
imduffy15 approved the PR at 22:32:48 UTC on 8 November 2026. cloudsmith-iduffy approved at 22:33:24 UTC and replied positively. These are recorded GitHub review approvals.
The automated Copilot reviewer recommended approval with no active issues, but submitted a COMMENTED review rather than a formal approval.
My cross-platform regression evidence
The PR reports that the new Bash regression failed against the original guard with the missing-ID-token error, then passed after the correction. Bash syntax, setup and version-bump suites and ShellCheck 0.9.0 passed on Linux.
The PowerShell 7.6.9 setup suite and PSScriptAnalyzer 1.25.0 passed. The PowerShell setup suite was also exercised on native Windows using byte-identical copies of the signed candidate's PowerShell source, without real credentials.
Seven isolated exact-source checks passed on my owner-operated Linux CI for head 8942e0f; the PR provides a SHA-256 receipt reference. These were not successful GitHub-hosted Actions jobs.
| Authentication configuration | Bash | PowerShell |
|---|---|---|
| Explicit API key + optional OIDC inputs, ID token absent | Accepted | Accepted |
| OIDC-only inputs, ID token absent | Rejected | Rejected |
Upstream merge and hosted-CI boundary
Cloudsmith merged PR #52 on 8 November 2026 at 22:33:39 UTC. Reviewed head 8942e0ffe5fc6d2d0df507fb0bef91a375e37a4a and upstream merge commit 1fafcbef6077a5aadd41423862ab0e59f8e457fd are recorded separately.
The contributor fork's GitHub Actions run #42526610749 was blocked by an account-level billing restriction before runnable test steps began (14 admission failures; 2 jobs skipped). No passing GitHub-hosted run, live Cloudsmith authentication test or separately confirmed action release is claimed.
- Reviewed contribution head
- 8942e0ffe5fc6d2d0df507fb0bef91a375e37a4a
- Upstream merge commit
- 1fafcbef6077a5aadd41423862ab0e59f8e457fd
Evidence, status and limits
The PR documents owner-operated isolated Linux checks and native Windows PowerShell regression testing, not passing GitHub-hosted CI or real Cloudsmith credentials. The contributor-fork run failed at runner admission because of billing restrictions. Merge confirms upstream acceptance of the patch, not an independently verified published action release or live authentication rollout.
Lessons and trade-offs
- Enforce permissions for the authentication path actually selected, not for unused optional configuration; least privilege should follow credential precedence.
- Test both the valid API-key override and the failing OIDC-only case on Bash and PowerShell, while distinguishing local evidence, hosted-CI admission and upstream merge.