chore: Cherry-picked changes from upstream

.github/workflows/test_install.yml

@@ -9,7 +9,7 @@ on:
 permissions:
   contents: read
 jobs:
-  build:
+  lint-shell:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -18,20 +18,43 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+
+      - name: Check shell script syntax
+        run: |
+          bash -n scripts/setup.sh
+          sh -n installer/install.sh
+
+      - name: Run ShellCheck
+        run: |
+          if command -v shellcheck >/dev/null 2>&1; then
+            shellcheck scripts/setup.sh installer/install.sh
+          else
+            sudo apt-get install -y shellcheck
+            shellcheck scripts/setup.sh installer/install.sh
+          fi
+
+  installer-drift:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
-          node-version: "24"
-      - name: Install dependencies
-        run: npm install
-      - name: Lint
-        run: npm run lint
-      - name: Build
-        run: npm run build
-      - name: Check for dist drift
+          egress-policy: audit
+
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Verify vendored installer checksums
         run: |
-          if ! git diff --quiet dist/; then
-            echo "::error::dist/ is out of sync with src/. Run 'npm run build' and commit the result."
-            git diff --stat dist/
+          expected_sh=$(awk '/install\.sh/{print $1}' installer/SHA256SUMS)
+          expected_ps1=$(awk '/install\.ps1/{print $1}' installer/SHA256SUMS)
+          actual_sh=$(sha256sum installer/install.sh | awk '{print $1}')
+          actual_ps1=$(sha256sum installer/install.ps1 | awk '{print $1}')
+          if [[ "$actual_sh" != "$expected_sh" ]]; then
+            echo "::error::installer/install.sh checksum mismatch (expected $expected_sh, got $actual_sh)"
+            exit 1
+          fi
+          if [[ "$actual_ps1" != "$expected_ps1" ]]; then
+            echo "::error::installer/install.ps1 checksum mismatch (expected $expected_ps1, got $actual_ps1)"
             exit 1
           fi
+          echo "Checksums verified."

README.md

@@ -2,44 +2,63 @@
 
 # Cloudsmith CLI Install Action
 
-This GitHub Action installs the Cloudsmith CLI and pre-authenticates it using OIDC or API Key. 🚀
+This GitHub Action installs the standalone Cloudsmith CLI, configures it on the PATH, and establishes authentication for subsequent workflow steps. No Python or Node.js required. 🚀
 
-> **⚠️ Notice:** If you are running on self-hosted runners, Python version 3.9 or higher is required. Please ensure your runner meets this requirement to avoid any issues. We recommend using [setup-python](https://github.com/actions/setup-python) action for installing Python. 🐍
+## Key Features
 
+The action supports two authentication approaches:
+
+1. **OIDC (Recommended)**: Uses short-lived credentials by exchanging GitHub OIDC tokens. Requires `id-token: write` permission and a Cloudsmith service account configured with an OIDC provider.
+
+2. **API Key**: Accepts stored credentials passed as GitHub Actions secrets, particularly recommended for service accounts rather than personal keys.
+
+## Platform Support
+
+Linux, macOS, and Windows runners on x86-64 and ARM64 (Linux and macOS).
 
 ## Inputs
 
 ### Authentication & Installation
 
-| Input                  | Description | Required | Default |
-|------------------------|-------------|----------|---------|
-| `cli-version` | Specific version of the Cloudsmith CLI to install | No | Latest |
+| Input | Description | Required | Default |
+|-------|-------------|----------|---------|
+| `cli-version` | Cloudsmith CLI version to install, e.g. `'1.20.0'`, or `'latest'` | No | `latest` |
+| `install-directory` | Root directory for versioned CLI installations | No | `RUNNER_TEMP/cloudsmith-cli` |
 | `api-key` | API Key for Cloudsmith authentication | No | - |
 | `oidc-namespace` | Cloudsmith organisation/namespace for OIDC | No | - |
 | `oidc-service-slug` | Cloudsmith service account slug for OIDC | No | - |
-| `oidc-auth-only` | Only perform OIDC authentication without installing the CLI | No | `false` |
-| `oidc-auth-retry` | Number of retry attempts for OIDC authentication (0-10), 5 seconds delay between retries | No | `3` |
-| `oidc-audience` | Audience to request when retrieving the GitHub OIDC token. Defaults to `https://github.com/{org-name}` using GITHUB_REPOSITORY_OWNER. You can override with a custom value like `api://AzureADTokenExchange` if needed. | No | `https://github.com/{org-name}` (dynamic) |
-| `pip-install` | Install the Cloudsmith CLI via pip | No | - |
-| `executable-path` | Path to the Cloudsmith CLI executable | No | `GITHUB_WORKSPACE/bin/` |
+| `oidc-audience` | Audience to request when retrieving the GitHub OIDC token. Defaults to `https://github.com/{org-name}` | No | `https://github.com/{org-name}` (dynamic) |
+| `verify-auth` | Run `cloudsmith whoami` after setup to verify authentication | No | `false` |
+| `export-auth-token` | Resolve credentials via `cloudsmith credential-helper generic` and export as `CLOUDSMITH_API_KEY` / `CLOUDSMITH_USERNAME`. Requires CLI 1.21.0+. | No | `false` |
+| `oidc-auth-only` | Deprecated alias for `export-auth-token` | No | `false` |
 
 ### CLI Configuration
 
 See [CLI configuration documentation](https://github.com/cloudsmith-io/cloudsmith-cli?tab=readme-ov-file#non-credentials-configini) for more details.
 
-| Input                  | Description | Required | Default |
-|------------------------|-------------|----------|---------|
+| Input | Description | Required | Default |
+|-------|-------------|----------|---------|
 | `api-host` | API Host for Cloudsmith | No | - |
 | `api-proxy` | API Proxy for Cloudsmith | No | - |
-| `api-ssl-verify` | Verify SSL certificates for Cloudsmith API | No | - |
-| `api-user-agent` | User Agent for Cloudsmith API | No | - | 
+| `api-ssl-verify` | Verify SSL certificates for Cloudsmith API: `true`, `false`, or empty | No | - |
+| `api-user-agent` | User Agent for Cloudsmith API | No | - |
+
+## Outputs
+
+| Output | Description |
+|--------|-------------|
+| `cli-version` | Resolved Cloudsmith CLI version |
+| `target` | Resolved standalone binary target, e.g. `linux-x86_64-gnu` |
+| `cli-path` | Absolute path to the Cloudsmith CLI executable |
+| `bin-directory` | Directory added to PATH |
+| `oidc-token` | Effective authentication token when `export-auth-token` is enabled (masked) |
 
 ## Example Usage with OIDC
 
 Cloudsmith OIDC [documentation](https://docs.cloudsmith.com/authentication/openid-connect)
 
 ```yaml
-uses: step-security/cloudsmith-cli-action@v2
+uses: step-security/cloudsmith-cli-action@v3
 with:
   oidc-namespace: 'your-oidc-namespace'
   oidc-service-slug: 'your-service-account-slug'
@@ -50,33 +69,32 @@ with:
 Personal API Key can be found [here](https://cloudsmith.io/user/settings/api/). For CI-CD deployments we recommend using [Service Accounts](https://docs.cloudsmith.com/accounts-and-teams/service-accounts).
 
 ```yaml
-uses: step-security/cloudsmith-cli-action@v2
+uses: step-security/cloudsmith-cli-action@v3
 with:
   api-key: 'your-api-key'
 ```
 
-## Example Usage with OIDC Authentication Only
+## Example Usage with export-auth-token
 
-If you only need to authenticate with Cloudsmith's API without installing the CLI:
+If you need the resolved token exported as an environment variable for downstream steps (e.g. for use with package managers):
 
 ```yaml
-uses: step-security/cloudsmith-cli-action@v2
+uses: step-security/cloudsmith-cli-action@v3
 with:
   oidc-namespace: 'your-oidc-namespace'
   oidc-service-slug: 'your-service-account-slug'
-  oidc-auth-only: 'true'
+  export-auth-token: 'true'
 ```
 
 This will:
-- Perform OIDC authentication
-- Set the OIDC token as `CLOUDSMITH_API_KEY` environment variable
-- Skip CLI installation
+- Perform OIDC authentication via the CLI credential-helper
+- Set `CLOUDSMITH_API_KEY` and `CLOUDSMITH_USERNAME` environment variables
+- Export the resolved token as the `oidc-token` action output
 
 ## Cloudsmith CLI Commands
 
 Full CLI feature list can be found [here](https://github.com/cloudsmith-io/cloudsmith-cli?tab=readme-ov-file#features)
 
-
 ### Publish a package
 
 For all supported package formats and upload commands please visit our [Supported Formats](https://docs.cloudsmith.com/formats) page.
@@ -97,10 +115,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Install Cloudsmith CLI
-        uses: step-security/cloudsmith-cli-action@v2
+        uses: step-security/cloudsmith-cli-action@v3
         with:
           oidc-namespace: 'your-oidc-namespace'
           oidc-service-slug: 'your-service-account-slug'