Install the standalone Cloudsmith CLI, add it to PATH, and configure authentication for the rest of a GitHub Actions job. The action does not require Python or Node.js on the runner.

Quick start · Configuration · Outputs · Migration guide · Contributing

OIDC is the recommended option for CI/CD because it uses short-lived credentials instead of a stored API key. Before using this example, configure a Cloudsmith service account and an OIDC provider by following the Cloudsmith OIDC documentation.

permissions:
  id-token: write
  contents: read

steps:
  - uses: cloudsmith-io/cloudsmith-cli-action@v3
    with:
      oidc-namespace: "YOUR-NAMESPACE"
      oidc-service-slug: "YOUR-SERVICE-ACCOUNT"

  - run: cloudsmith whoami

Store the API key as a GitHub Actions secret and pass it to the action. For automated workflows, use a Cloudsmith service account rather than a personal API key.

steps:
  - uses: cloudsmith-io/cloudsmith-cli-action@v3
    with:
      api-key: ${{ secrets.CLOUDSMITH_API_KEY }}

  - run: cloudsmith whoami

Personal API keys are available from Cloudsmith API settings.

Choose one of the following authentication methods:

With OIDC, the action exports the service account context needed by the CLI. The Cloudsmith access token is requested only when the CLI first needs to authenticate and is not exposed as an action output.

flowchart LR
    A[Setup action] -->|Installs CLI and exports OIDC settings| B[Cloudsmith CLI command]
    B -->|Requests identity token| C[GitHub OIDC]
    C -->|Exchanges identity| D[Cloudsmith]

Set verify-auth: "true" to run cloudsmith whoami during setup and fail early if authentication is not configured correctly.

An authentication method is required: provide api-key, or provide both oidc-namespace and oidc-service-slug.

Access an output through the action step's id:

steps:
  - name: Set up Cloudsmith CLI
    id: cloudsmith
    uses: cloudsmith-io/cloudsmith-cli-action@v3
    with:
      api-key: ${{ secrets.CLOUDSMITH_API_KEY }}

  - run: echo "Installed Cloudsmith CLI ${{ steps.cloudsmith.outputs.cli-version }}"

The action configures later steps by exporting the environment variables that correspond to the supplied inputs.

The following workflow installs the CLI with OIDC authentication and publishes a Python package:

name: Publish Python package

on:
  push:
    branches:
      - main

permissions:
  id-token: write
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Cloudsmith CLI
        uses: cloudsmith-io/cloudsmith-cli-action@v3
        with:
          oidc-namespace: "YOUR-NAMESPACE"
          oidc-service-slug: "YOUR-SERVICE-ACCOUNT"

      - name: Publish package
        run: cloudsmith push python YOUR-NAMESPACE/YOUR-REPOSITORY dist/*.tar.gz

See Supported Formats for the upload command and options for each package format.

Version 3 installs the standalone CLI instead of the Python package. Existing workflows that use api-key, or the oidc-namespace and oidc-service-slug pair, can keep those authentication inputs and the existing default OIDC audience.

See the contribution guide for the repository layout, local validation commands, and pull request process.

For help, open a GitHub issue or contact Cloudsmith Support.

This project is available under the MIT License.