The Cloudsmith CLI now eliminates the need for static API keys in CI/CD pipelines by automatically discovering OpenID Connect (OIDC) credentials for all major CI/CD platforms and includes a Docker credential helper to automatically authenticate to Cloudsmith registries.

Automatic discovery of OIDC credentials

Static, long-lived API keys in CI/CD pipelines are a security liability and an operational burden: they need to be created, distributed as secrets, rotated, and revoked.

v1.18.0 introduced automatic OIDC credential discovery for AWS. v1.19.0 extends it to every major CI/CD platform, so pipelines can exchange their native workload identity token for a short-lived Cloudsmith token with zero stored secrets.

How it works

Set CLOUDSMITH_ORG and CLOUDSMITH_SERVICE_SLUG in the pipeline, and the CLI does the rest: it detects which CI environment it’s running in, obtains the platform's native OIDC token, and exchanges it with Cloudsmith for a short-lived access token.

No API key is ever stored.

Supported services:

• AWS
• GitHub Actions
• GitLab CI
• Bitbucket Pipelines
• CircleCI
• Azure DevOps
• Generic fallback

All detectors work out of the box with no additional Python dependencies. For fine-grained control, individual detectors can be disabled and the detection order overridden via environment variables, CLI options, or config.ini.

For details, see Automatically discover OIDC credentials.

Docker credential helper

With the credential helper, Docker can automatically discover credentials from the CLI, including for custom registry domains. Previously, authenticating Docker against Cloudsmith registries required manual docker login with an API key per registry domain.

How it works

Running cloudsmith credential-helper install docker installs a docker-credential-cloudsmith binary and registers it in ~/.docker/config.json for Cloudsmith registry domains. Custom domains are discovered automatically via the Cloudsmith API and cached.

After installing the helper, docker pull and docker push against Cloudsmith registries authenticate with the CLI's existing credentials with no docker login.

For details, see Automatically discover Docker credentials.

Docker image updates

• The official Docker image now runs as a non-root user
• Vulnerable dependencies have been upgraded, resolving all open Dependabot alerts
• A packaging fix ensures zipapp (.pyz) builds start correctly on macOS

For a full summary of changes, please visit the GitHub changelog.