[cloudsmith-iduffy]

Description

Before this change, cli-version defaulted to latest. A workflow that pinned this action to a commit SHA still got a different CLI whenever a new CLI shipped. This PR pins the CLI version and automates releases when the CLI changes.

• Pinned default. cli-version now defaults to 1.29.0 in action.yml. That value is the one source of truth for the pin. cli-version: latest and explicit versions still override it.
• Bump script. scripts/bump-cli-version.sh <version> updates the pin and adds a release section to CHANGELOG.md. The release is a patch release, or a minor release when [Unreleased] has entries, so a CLI bump never ships a feature as a patch. If the version is already pinned, the script does nothing.
• Bot PRs. Each cloudsmith-cli release sends a cloudsmith-cli-release event to this repo. The new Bump Cloudsmith CLI workflow runs the bump script through the CLI repo's open-cli-bump-pr action, which makes an SSH-signed commit as cloudsmith-bot and opens or updates the PR. You can also run the workflow by hand with a version. The Homebrew tap uses the same flow (feat(ENG-14534): bump the formula from the CLI release event homebrew-cloudsmith-cli#41).
• Release on merge. release.yml now runs when CHANGELOG.md changes on master. If the newest CHANGELOG version has no tag, it calls test.yml as a reusable workflow. If the tests pass, it creates the tag and GitHub release and moves v3. If they fail, it creates no tag, and the run shows as failed on the commit.
• Tests. Each install job checks that the cli-version output matches the pinned default. A new job covers cli-version: latest. The bump script has its own test (scripts/test-bump-cli-version.sh), which runs on Linux and macOS.

This PR adds a 3.2.0 CHANGELOG section, so merging it also tests the new release path: it should tag v3.2.0 and move v3.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

• Add two secrets to this repo: DOWNSTREAM_RELEASE_PUSH_TOKEN and CLOUDSMITH_BOT_SSH_KEY, with the same values as in cloudsmith-io/cloudsmith-cli. A PR opened with the default GITHUB_TOKEN does not start the tests.
• Depends on chore(ENG-14534): send a release event to downstream repositories cloudsmith-cli#451. That PR sends the event and contains the open-cli-bump-pr action. bump-cli-version.yml pins the action to a commit on the #451 branch. After #451 merges, repin it to the merged commit on master.
• Releases no longer start from a tag push. To release action changes, add a version section to CHANGELOG.md. CONTRIBUTION.md describes the flow.
• The org ruleset requires one approving review on master, so a person still approves each bot PR, as with the Homebrew tap. To make the flow fully hands-off, an org admin can add cloudsmith-bot as a bypass actor and the bot job can merge its own PR.
• Local verification:
  • scripts/test-bump-cli-version.sh passes with BSD awk (macOS) and mawk (Ubuntu 24.04).
  • zizmor --pedantic is clean.
  • A dry run of the bot job produced a valid SSH-signed commit from Cloudsmith Bot.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Release queueing and retry behavior can skip or strand automated releases.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Preserve all queued releases with queue max · New
• Make release creation idempotent on reruns · New
• Add required copyright header · New

What changed in this PR

Pins the default Cloudsmith CLI version and automates action releases following CLI bumps.

Changes:

• Adds CLI-version bumping and regression tests.
• Converts release automation to CHANGELOG-driven, tested releases.
• Updates action defaults and release documentation.

File	Description
action.yml	Pins CLI 1.27.0 by default.
CHANGELOG.md	Adds the 3.2.0 release entry.
README.md	Documents pinned and latest selection.
CONTRIBUTION.md	Documents testing and release procedures.
scripts/​bump-cli-version.sh	Automates pin and CHANGELOG updates.
scripts/​test-bump-cli-version.sh	Tests bump behavior.
.github/​workflows/​test.yml	Adds reusable and version-focused tests.
.github/​workflows/​release.yml	Implements CHANGELOG-driven releases.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.