feat(no-ticket): Add cloudsmith tokens show command - #341
Closed
BartoszBlizniak wants to merge 3 commits into
Closed
feat(no-ticket): Add cloudsmith tokens show command #341BartoszBlizniak wants to merge 3 commits into
cloudsmith tokens show command #341BartoszBlizniak wants to merge 3 commits into
Conversation
CI users previously received the OIDC-exchanged Cloudsmith token from the v2 GitHub Action and fed it to registry clients (.npmrc, pip, docker login). v3 integrations keep the exchange inside the CLI by design, leaving no sanctioned way to retrieve the token for third-party consumers. 'cloudsmith tokens show' is the explicit, opt-in read path: it resolves credentials through the same chain as every authenticated command (flag, env, credentials file, keyring, OIDC), performing the lazy OIDC exchange when that is the resolving source, and prints only the token to stdout. Nothing is auto-exported, so the leak-free default stays intact, and no API endpoint is called. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new cloudsmith tokens show subcommand that exposes the effective authentication token currently used by the CLI (including triggering OIDC exchange when that is the resolving source), primarily to support CI/package-manager integrations that need the short-lived exchanged token.
Changes:
- Add
cloudsmith tokens showcommand with plain output (token only) and JSON output (includes source/auth metadata and optional expiry). - Expose JWT expiry decoding helper for OIDC token expiry reporting.
- Document the new command in README and CHANGELOG, and add CLI tests covering env-var and OIDC flows.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| README.md | Documents cloudsmith tokens show usage patterns (shell export + GitHub Actions masking) and JSON output shape. |
| cloudsmith_cli/core/credentials/oidc/cache.py | Renames/exports JWT expiry decoding helper used for expiry reporting. |
| cloudsmith_cli/cli/tests/commands/test_tokens_show.py | Adds tests for plain vs JSON output and OIDC-based resolution. |
| cloudsmith_cli/cli/commands/tokens.py | Implements the new tokens show subcommand and JSON payload details. |
| CHANGELOG.md | Notes the new tokens show feature and its intended CI/registry-client use case. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
BartoszBlizniak
marked this pull request as ready for review
August 3, 2026 09:42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
With the recent CLI changes, we are now forcing OIDC authentication via our integrations to be completed by the CLI. This has also removed the ability for customers to retrieve the short-lived authentication token, which could be used to authenticate with package managers that talk to Cloudsmith.
This PR adds a new
showsub-command to thecloudsmith tokenscommand, which exposes the currently authenticated token that is being used to talk with Cloudsmith.This PR restores the default GitHub Action behavior for
oidc-auth-onlywithout requiring additional code in the integration.Type of Change
Additional Notes
N/A