[cloudsmith-iduffy]

Description

Each CLI release has to update other repositories, such as the Homebrew tap and cloudsmith-cli-action, and more are planned. Before this PR, the release workflow held the bump logic for each of those repositories as inline YAML. The tap and action jobs were near duplicates, and you could not run either one outside a workflow run.

After this PR, each downstream repository owns its own change:

• One event from the CLI. The new notify-downstream-repos job runs after publish-github. It sends a cloudsmith-cli-release event with the version to each repository in its matrix. To add a repository, add its name to the matrix.
• One shared action for the PR. .github/actions/open-cli-bump-pr is a composite action that downstream workflows call. It clones the calling repository, runs that repository's bump command, and opens or updates a PR from cloudsmith-bot. It keeps the behaviour of the old jobs:
  • It uses one release/cloudsmith-cli branch.
  • A newer release replaces a bump that is not merged yet.
  • An older release never replaces a newer one.
  • With merge: "true", it squash-merges the PR when the checks pass.
• Repository-specific logic stays in each repository. The tap gets scripts/bump-cli-version.py (feat(ENG-14534): bump the formula from the CLI release event homebrew-cloudsmith-cli#41). It reads the sha256 values from the release's SHA256SUMS and checks the downloads against them. The action uses its existing scripts/bump-cli-version.sh (feat(ENG-14534): pin the CLI version and release on each CLI bump cloudsmith-cli-action#49). Each repository can run its bump by hand through workflow_dispatch.

This PR removes publish-homebrew, publish-action, the Homebrew template, and the setup-cloudsmith-bot-git action that the earlier commits of this PR added.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

• Merge order. Merge this PR first. Then repin the open-cli-bump-pr reference in feat(ENG-14534): bump the formula from the CLI release event homebrew-cloudsmith-cli#41 and feat(ENG-14534): pin the CLI version and release on each CLI bump cloudsmith-cli-action#49 to the merged commit on master, and merge those PRs before the next CLI release. If a release ships before they merge, run their Bump Cloudsmith CLI workflow by hand.
• Secrets. DOWNSTREAM_RELEASE_PUSH_TOKEN must be able to send repository_dispatch to each downstream repository, which needs contents write access. The tap and the action repository also need DOWNSTREAM_RELEASE_PUSH_TOKEN and CLOUDSMITH_BOT_SSH_KEY as their own secrets. A PR opened with GITHUB_TOKEN does not start their checks. Without DOWNSTREAM_RELEASE_PUSH_TOKEN, the notify-downstream-repos job fails. After this merges, nothing uses TAP_PUSH_TOKEN.
• Order change. The tap now updates after the GitHub release is published, not before. That lets the tap read SHA256SUMS without authentication.
• Tests. The workflows have no tests. zizmor and pre-commit pass. actionlint 1.7.12 does not know the queue key in concurrency.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Concurrent releases can generate duplicate action versions and prevent the later action release.

Review effort: Balanced
Findings: 1

Open (1)

• Prevent concurrent CLI release bumps from duplicating action versions · New

What changed in this PR

Adds automation to update cloudsmith-cli-action after each CLI release.

Changes:

• Adds a release job that opens a signed version-bump PR.
• Extracts shared bot signing setup into a composite action.

File	Description
.github/​workflows/​release.yml	Adds action-repository publishing and reuses signing setup.
.github/​actions/​setup-cloudsmith-bot-git/​action.yml	Configures Cloudsmith Bot identity and SSH signing.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Older release reruns can overwrite a newer unmerged action bump.

Review effort: Balanced
Findings: 1

Open (1)

• Prevent older release reruns from overwriting newer dependency bumps · New

Resolved since last review (1)

• Prevent concurrent CLI release bumps from duplicating action versions

Previously missed (1)

In code that hasn't changed since last review

Add required copyright comment to new source file

.github/​actions/​setup-cloudsmith-bot-git/​action.yml:1

This new source file is missing the repository-required copyright comment near the top.

[Copilot]

Copilot review overview

🟡 Changes recommended

Release queue replacement and a PR-merge race can cause action bumps to be lost.

Review effort: Balanced
Findings: 2

Open (2)

• Pending releases can be canceled despite cancel-in-progress being false · New
• Closed PR race can lose or duplicate the release bump · New

Resolved since last review (1)

• Prevent older release reruns from overwriting newer dependency bumps

[coillteoir]

I think it would be better to let dependabot handle it. At the end of the day it is a downstream consumer.

[cloudsmith-iduffy]

I think it would be better to let dependabot handle it. At the end of the day it is a downstream consumer.

Interesting idea! let me look into this, I know we do similar with renovate over here https://github.com/cloudsmith-io/devops-live/blob/master/renovate.json

Likely we should update the homebrew formula to follow the same flow.

[cloudsmith-iduffy]

I think it would be better to let dependabot handle it. At the end of the day it is a downstream consumer.

Doesn't look to be possible with dependabot - no way to each it of custom file formats. We can do it with renovate though:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "enabledManagers": ["custom.regex", "github-actions"],
  "customManagers": [
    {
      "customType": "regex",
      "fileMatch": ["^action\\.yml$"],
      "matchStrings": ["cli-version:[\\s\\S]*?default:\\s*\"(?<currentValue>[^\"]+)\""],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "cloudsmith-io/cloudsmith-cli",
      "extractVersionTemplate": "^v?(?<version>.*)$",
      "versioningTemplate": "semver"
    }
  ]
}

but this doesn't seem to have good outcomes for a few different reasons

• Changelog wouldn't get updated
• Renovate runs on its own cycle rather than insanely when we do a release

[UsmanGhias]

Clean patch for cloudsmith-io/cloudsmith-cli.

Observations:

• Code structure follows standard OCA guidelines and cleanly isolates the extension logic.

Ready for testing on standard environments.

Regards,
Usman
https://usmanghias.co.uk

[coillteoir]

I think it would be better to let dependabot handle it. At the end of the day it is a downstream consumer.

Doesn't look to be possible with dependabot - no way to each it of custom file formats. We can do it with renovate though:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "enabledManagers": ["custom.regex", "github-actions"],
  "customManagers": [
    {
      "customType": "regex",
      "fileMatch": ["^action\\.yml$"],
      "matchStrings": ["cli-version:[\\s\\S]*?default:\\s*\"(?<currentValue>[^\"]+)\""],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "cloudsmith-io/cloudsmith-cli",
      "extractVersionTemplate": "^v?(?<version>.*)$",
      "versioningTemplate": "semver"
    }
  ]
}

but this doesn't seem to have good outcomes for a few different reasons

• Changelog wouldn't get updated
• Renovate runs on its own cycle rather than insanely when we do a release

Yeah, renovate, etc. Could in theory solve this. Maybe we could look at some structural schemas for the cloudsmith CLI action. See if theres a way to get it installing using a dependabot supported package manager like homebrew or winget?

Otherwise I'm not going to block this solution. It would be nice to see if we can let dependabot pick up the changes though

[BartoszBlizniak]

LGTM - I've updated the token to be a more generic name DOWNSTREAM_RELEASE_PUSH_TOKEN and replaced the current TAP_PUSH token so that we can use it for both homebrew/gha (and anything else in the future).