feat: update bindings to v2.0.29 (API v1.1285.0) and automate future updates (#96)

Binding version: 2.0.29
CloudSmith API version: 1.1285.0

Bindings:
- Regenerate Python, Ruby, and Java bindings against API v1.1285.0

Tooling and automation:
- Automate the Ruby apostrophe escaping (swagger-codegen emits an unescaped
  single-quoted enum value) in scripts/fix-ruby-escaping.sh using ruby, invoked
  from bindings/ruby/build.sh so a single build always emits valid Ruby
- Make linting a mandatory build step: scripts/build.sh runs `ruff check --fix`,
  which fails only on genuinely unfixable violations
- Harden update-bindings.sh: run pre-commit to convergence and refuse to push
  when a hook aborts the commit
- Manage the host toolchain with mise via a top-level .mise.toml (ruby, python,
  uv, jq) shared by local dev and CI
- Add the "Update API bindings" GitHub Actions workflow: regenerate and open a
  PR on demand or daily, only when the bindings actually change, closing any
  superseded automated PRs first
- Move linting and security scanning to GitHub Actions (mirroring
  cloudsmith-cli): a Lint workflow runs ruff via mise, and a Security workflow
  runs zizmor via zizmorcore/zizmor-action; the CircleCI pre-commit job is
  removed, leaving CircleCI to only test and deploy the bindings
- Harden the workflows against zizmor's findings: pass workflow_dispatch inputs
  and step outputs through env instead of interpolating them into run blocks,
  set persist-credentials: false, and hash-pin all actions to the latest release
- chmod 755 the source shell scripts
- Document the mise + Docker workflow in README.md and CONTRIBUTING.md

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cloudsmith-iduffy

.circleci/config.yml

@@ -58,27 +58,11 @@ jobs:
       - prepare_deploy_environment
       - deploy_bindings:
           language: <<parameters.language>>
-  pre_commit:
-    description: "Run pre-commit hooks"
-    docker:
-      - image: cimg/python:3.8
-    steps:
-      - checkout
-      - run:
-          name: "Install dependencies"
-          command: |
-            python3 -m pip install --upgrade pip
-            pip install pre-commit
-      - run:
-          name: "Run pre-commit"
-          command: pre-commit run --all-files
-
 
 workflows:
   version: 2
   test_and_deploy:
     jobs:
-      - pre_commit
       - test:
           name: "Test Java"
           language: java

.github/workflows/lint.yml

@@ -0,0 +1,33 @@
+name: Lint
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - "**"
+
+permissions:
+  contents: read
+
+jobs:
+  ruff:
+    name: Check Python style (ruff)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        with:
+          install: false
+
+      - name: Install tools with mise
+        run: mise install python uv
+
+      - name: Run ruff
+        run: mise exec python uv -- uvx prek run ruff --all-files

.github/workflows/update-bindings.yml

@@ -0,0 +1,107 @@
+name: Update API bindings
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Binding version (leave blank to auto-increment the patch version)"
+        required: false
+        type: string
+  schedule:
+    # Daily at 06:00 UTC
+    - cron: "0 6 * * *"
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-bindings:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up tools
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+
+      - name: Generate bindings
+        run: mise run build
+
+      - name: Detect changes
+        id: detect
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          if [ -n "$INPUT_VERSION" ] || [ -n "$(git status --porcelain)" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "Bindings already match the current API; no PR needed."
+          fi
+
+      - name: Bump version and regenerate
+        if: steps.detect.outputs.changed == 'true'
+        id: versions
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          api_version=$(curl -s --max-time 30 "https://api.cloudsmith.io/status/check/basic/" | jq -r '.version')
+          if [ -z "$api_version" ] || [ "$api_version" = "null" ]; then
+            echo "Could not fetch CloudSmith API version" >&2
+            exit 1
+          fi
+
+          current_version=$(grep -E '^package_version=' scripts/common.sh | cut -d'"' -f2)
+          if [ -n "$INPUT_VERSION" ]; then
+            new_version="$INPUT_VERSION"
+          else
+            IFS='.' read -r major minor patch <<< "$current_version"
+            new_version="${major}.${minor}.$((patch + 1))"
+          fi
+
+          sed -i -E "s/^package_version=.*/package_version=\"${new_version}\"/" scripts/common.sh
+          mise run build
+
+          echo "api_version=$api_version" >> "$GITHUB_OUTPUT"
+          echo "new_version=$new_version" >> "$GITHUB_OUTPUT"
+
+      - name: Close stale automated binding PRs
+        if: steps.detect.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          NEW_VERSION: ${{ steps.versions.outputs.new_version }}
+        run: |
+          keep="automated/update-bindings-v${NEW_VERSION}"
+          gh pr list --state open --json number,headRefName \
+            --jq '.[]
+              | select(.headRefName | startswith("automated/update-bindings-"))
+              | select(.headRefName != "'"$keep"'")
+              | .number' \
+          | while read -r number; do
+              [ -n "$number" ] || continue
+              gh pr close "$number" --delete-branch \
+                --comment "Superseded by automated bindings update v${NEW_VERSION}."
+            done
+
+      - name: Create pull request
+        if: steps.detect.outputs.changed == 'true'
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          branch: automated/update-bindings-v${{ steps.versions.outputs.new_version }}
+          base: master
+          title: "feat: update bindings to v${{ steps.versions.outputs.new_version }} (API v${{ steps.versions.outputs.api_version }})"
+          commit-message: "feat: update bindings to v${{ steps.versions.outputs.new_version }} (API v${{ steps.versions.outputs.api_version }})"
+          body: |
+            Automated API bindings update.
+
+            - Binding version: `${{ steps.versions.outputs.new_version }}`
+            - CloudSmith API version: `${{ steps.versions.outputs.api_version }}`
+
+            Generated by the **Update API bindings** workflow.
+          labels: |
+            bindings
+            automated
+          delete-branch: true

.github/workflows/zizmor.yml

@@ -0,0 +1,32 @@
+name: Security
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - ".github/workflows/**"
+  pull_request:
+    branches:
+      - "**"
+    paths:
+      - ".github/workflows/**"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Scan GitHub Actions workflows
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7

.mise.toml

@@ -0,0 +1,18 @@
+# Host toolchain for working with this repo. Note: binding generation runs
+# inside the pinned swaggerapi/swagger-codegen-cli Docker image (see
+# scripts/common.sh), so Docker remains a separate prerequisite that mise does
+# not manage. The CircleCI test matrix pins its own runtimes via cimg images.
+
+[tools]
+ruby = "3.4"
+python = "3.12"
+uv = "latest"
+jq = "latest"
+
+[tasks.build]
+description = "Generate all API bindings and apply ruff autofixes (requires Docker)"
+run = "./scripts/build.sh"
+
+[tasks.update-bindings]
+description = "Bump the version, regenerate bindings, and open a PR"
+run = "./scripts/update-bindings.sh"

.pre-commit-config.yaml

@@ -4,3 +4,7 @@ repos:
   hooks:
     - id: ruff
       args: [ --fix ]
+- repo: https://github.com/zizmorcore/zizmor-pre-commit
+  rev: v1.27.0
+  hooks:
+    - id: zizmor

CONTRIBUTING.md

@@ -4,19 +4,25 @@ Please refer to Cloudsmith's standard guide on [Open-Source Contributing](https:
 
 ## Updating bindings
 
+The host toolchain is managed with [mise](https://mise.jdx.dev/) via the top-level `.mise.toml`, so local and CI environments use the same tools. Run `mise install` once to get them. You also need [Docker](https://www.docker.com/) running, as generation happens inside the pinned `swagger-codegen-cli` image (see `scripts/common.sh`). Linting (`ruff`) runs automatically as part of the build.
+
 ### Manual approach
 
 * Update `package_version` in `scripts/common.sh`
-* Run `./scripts/build.sh` to generate bindings
-* Create a PR specifing API and binding version
+* Run `mise run build` to generate the bindings (ruff autofixes are applied as part of the build)
+* Create a PR specifying the API and binding version
 
 ### Automated approach
 
-* Run `./scripts/update-bindings.sh` to automatically update the bindings.
+* Run `mise run update-bindings` to automatically update the bindings.
 * This will then provide you with the URL for the PR to release the updated bindings.
-* Preferred usage: `./scripts/update-bindings.sh`
 * For full options and usage examples, run: `./scripts/update-bindings.sh --help`
 
+### Scheduled / on-demand automation
+
+* The `Update API bindings` GitHub Actions workflow regenerates the bindings and opens a PR — daily on a schedule, or on demand via **Run workflow** (optionally with a specific version).
+* It only opens a PR when the regenerated bindings actually change.
+
 ## Contributor License Agreement
 
 By making any contributions to Cloudsmith Ltd projects you agree to be bound by the terms of the Cloudsmith Ltd [Contributor License Agreement](https://docs.cloudsmith.com/contributor-license-agreement).

README.md

@@ -40,6 +40,27 @@ To receive configuration help (in order to setup `build.sh` correctly), execute:
 Where `<language>` is the language you're generating bindings for (e.g. `python`).
 
 
+## Local Development
+
+The host toolchain is managed with [mise](https://mise.jdx.dev/) via the top-level `.mise.toml`, so local development and CI use the same tools. With mise installed:
+
+```sh
+mise install   # installs the pinned host tools (ruby, uv, jq)
+```
+
+You also need [Docker](https://www.docker.com/) running — binding generation happens inside the pinned `swagger-codegen-cli` image (see `scripts/common.sh`), which mise does not manage.
+
+Common tasks:
+
+```sh
+mise run build             # regenerate all bindings; ruff autofixes are applied as part of the build
+mise run update-bindings   # bump the version, regenerate the bindings, and open a pull request
+```
+
+Linting is a mandatory step of `build`: `ruff` fixes issues in place and fails the build only if it finds something it cannot fix, so a successful `mise run build` always produces lint-clean bindings.
+
+Binding updates also run automatically through the `Update API bindings` GitHub Actions workflow — daily on a schedule, or on demand via **Run workflow** (optionally with a specific version). It opens a pull request only when the regenerated bindings actually change.
+
 ## Versioning
 
 The version of the generated library bindings is automatically made to match the upstream API. So if the Cloudsmith API is currently `0.22.2`, then the language bindings will also be `0.22.2`.

bindings/java/src/README.md

@@ -40,7 +40,7 @@ Add this dependency to your project's POM:
 <dependency>
   <groupId>io.cloudsmith.api</groupId>
   <artifactId>cloudsmith-api</artifactId>
-  <version>2.0.27</version>
+  <version>2.0.29</version>
   <scope>compile</scope>
 </dependency>
 ```
@@ -50,7 +50,7 @@ Add this dependency to your project's POM:
 Add this dependency to your project's build file:
 
 ```groovy
-compile "io.cloudsmith.api:cloudsmith-api:2.0.27"
+compile "io.cloudsmith.api:cloudsmith-api:2.0.29"
 ```
 
 ### Others
@@ -63,7 +63,7 @@ mvn clean package
 
 Then manually install the following JARs:
 
-* `target/cloudsmith-api-2.0.27.jar`
+* `target/cloudsmith-api-2.0.29.jar`
 * `target/lib/*.jar`
 
 ## Getting Started

bindings/java/src/build.gradle

@@ -2,7 +2,7 @@ apply plugin: 'idea'
 apply plugin: 'eclipse'
 
 group = 'io.cloudsmith.api'
-version = '2.0.27'
+version = '2.0.29'
 
 buildscript {
     repositories {