Bump cloudsmith-io/cloudsmith-cli-action from 3.0.1 to 3.1.0

[dependabot]

Bumps cloudsmith-io/cloudsmith-cli-action from 3.0.1 to 3.1.0.

Release notes

Sourced from cloudsmith-io/cloudsmith-cli-action's releases.

Release v3.1.0

What's Changed

• feat: export CLI-resolved authentication token and bring back oidc-auth-only as alias to export-auth-token input which achieves the same output by authenticating via CLI instead of raw API calls used by previous action; by @​BartoszBlizniak in cloudsmith-io/cloudsmith-cli-action#43

Full Changelog: cloudsmith-io/cloudsmith-cli-action@v3.0.1...v3.1.0

Changelog

Sourced from cloudsmith-io/cloudsmith-cli-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

---

[3.1.0] - 2026-08-03

---

Added

• export-auth-token now resolves the effective credential through cloudsmith credential-helper generic, validates its version-1 JSON response, exports password as CLOUDSMITH_API_KEY, exports the helper's username as CLOUDSMITH_USERNAME, and preserves the masked oidc-token compatibility output. oidc-auth-only remains a deprecated alias that enables the same flow.

[3.0.0] - 2026-07-30

---

Breaking Changes

• Composite action - The action is now a composite action that installs the standalone Cloudsmith CLI binary via bundled installer scripts. No Python or Node.js runtime is required.
• CLI-native OIDC - The CLI performs the OIDC token exchange on its first authenticated command; the action only exports CLOUDSMITH_ORG, CLOUDSMITH_SERVICE_SLUG, and CLOUDSMITH_OIDC_AUDIENCE. The default audience remains https://github.com/{repository-owner}.
• Removed inputs - pip-install, oidc-auth-only, oidc-auth-retry, oidc-token-validate, and executable-path. See the README migration table.
• Removed output - oidc-token. The action never holds a Cloudsmith token.
• No config file - api-host, api-proxy, api-ssl-verify, and api-user-agent are exported as CLOUDSMITH_* environment variables instead of being written to a config file.

Added

• install-directory input to control where versioned CLI installations live.
• verify-auth input to run cloudsmith whoami after setup.
• cli-version, target, cli-path, and bin-directory outputs.
• Linux ARM64 (glibc and musl) and macOS ARM64 support via the standalone binaries.

[2.0.3] - 2026-05-08

---

Security

• Mask the OIDC-issued Cloudsmith API token as a secret so it is replaced with *** in any subsequent workflow log line. The token was previously exported via core.exportVariable("CLOUDSMITH_API_KEY", token) and core.setOutput('oidc-token', token) without first calling core.setSecret(token), so a downstream step that printed $CLOUDSMITH_API_KEY (e.g. via set -x or accidental echo) would leak the bearer token in clear text.

Fixed

• pip-install: 'true': the Cloudsmith Python index URL is now actually forwarded to pip install. Previously, --index-url=... was passed as the third positional argument to @actions/exec's exec() (which is the options object, not extra CLI args), so the flag was silently dropped and cloudsmith-cli was resolved from PyPI alone. The flag is now passed inside the args array as --extra-index-url=..., so pip searches both PyPI and the Cloudsmith index when resolving cloudsmith-cli and its transitive dependencies (click, click-configfile, etc.).

[2.0.1] - 2025-12-23

---

Changed

• Replaced axios with native Node Fetch

[2.0.0] - 2025-12-19

... (truncated)

Commits

• ad73faf feat: export CLI-resolved authentication token (#43)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)