Repository navigation
feat: export the CLI-resolved authentication token - #17
Merged
Merged
Conversation
Version 2 keeps the OIDC exchange inside the CLI. Pipelines that used the exchanged token with other tools, such as docker, npm, or pip, lost the read path that version 1 gave through oidcAuthOnly. Add the opt-in exportAuthToken input. The task runs 'cloudsmith credential-helper generic' once and validates the version 1 JSON response. It exports the password as the secret variable CLOUDSMITH_API_KEY and the username as CLOUDSMITH_USERNAME. When verifyAuth is also set, whoami uses the exported token, so OIDC does one exchange only. The input requires Cloudsmith CLI 1.21.0 or later. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 of 6 tasks
cloudsmith-iduffy
changed the title
cloudsmith-iduffy
marked this pull request as ready for review
September 24, 2026 11:39
cloudsmith-iduffy
requested review from
a team and
opswithranjan
as code owners
September 24, 2026 11:39
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Add Windows fixture support and run the export tests on Windows.
Review effort: Lite
Findings: None
What changed in this PR
Adds opt-in export of the CLI-resolved Cloudsmith authentication token for use by other Azure Pipelines tools.
Changes:
- Adds
exportAuthTokenand credential-helper integration. - Exports Cloudsmith API credentials and reuses OIDC tokens.
- Updates tests, documentation, fixtures, changelog, and version metadata.
The new export tests skip Windows, leaving the flow untested on supported Windows agents.
| File | Summary |
|---|---|
vss-extension.json |
Updates extension version. |
tests/main.test.js |
Tests token export and validation behavior. |
tests/fixtures/fake-installer/cloudsmith |
Supports credential-helper test scenarios. |
tests/contract.test.js |
Validates the manifest input contract. |
README.md |
Documents configuration and usage. |
overview.md |
Updates feature and migration guidance. |
cloudsmith-task/task.json |
Defines the new input. |
cloudsmith-task/package.json |
Updates task version. |
cloudsmith-task/package-lock.json |
Synchronizes lockfile version. |
cloudsmith-task/main.js |
Resolves and exports credentials. |
CHANGELOG.md |
Records the 2.1.0 feature. |
Files not reviewed (1)
- cloudsmith-task/package-lock.json: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📄 Summary
A user reports that after the upgrade to
@2, they cannot get a Cloudsmith API key to use with other tools. Version@2keeps the OIDC exchange inside the CLI and removedoidcAuthOnly, so the exchanged token is no longer exported.This PR adds the opt-in
exportAuthTokeninput. It uses the same credential-helper approach asexport-auth-tokenincloudsmith-io/cloudsmith-cli-action:🧪 Type of Change
[FIX]Bug fix[NEW]New thing[REFACTOR]Internal changes such as code restructuring or optimization that does not alter functionality[DOC]Documentation-only changes[CHORE]Maintenance, cleanup, or CI configuration🧪 How Has This Been Tested?
npm testlocally: 31 of 31 tests pass. New tests cover response validation, OIDC and API-key export, the default-off case, the inherited-token case,verifyAuthtoken reuse, helper failure, an unsupported response, and the manifest input.cloudsmithfixture now handlescredential-helper generic. The new tests that run the fixture are skipped on Windows, like the existingwhoamitests.npx tfx-cli@0.23.4 extension createpackages version2.1.0.✅ Checklist