feat: publish standalone binaries via the release + Docker pipelines (ENG-12827)

Wire the standalone PyInstaller binaries (ENG-12826) into the release and Docker
pipelines, dogfooding the freshly-built cloudsmith binary to authenticate
(GitHub OIDC) and publish:

- Publish per-platform archives + SHA256 to Cloudsmith and build/push the
  container image, using the built binary + OIDC and the Docker credential
  helper instead of cloudsmith-cli-action / static-key docker login.
- GPG-sign the Linux archives (detached .sig sibling files).
- Idempotent, immutable-repo-safe publishing (skip already-published artifacts/tags).
- Tag raw uploads (os/arch/libc/target/type) for queryable CI selection.
- Dockerfile: multi-stage Alpine, musl binary, non-root, OCI labels; Docker Hub floating tags.
- CI hardening + perf: single-source target list, composite bootstrap action,
  GH_REPO for gh, trimmed clean-room docker runs, pinned runners.
- Redact PII from online smoketest logs (SMOKETEST_DEBUG for detail).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: BartoszBlizniak

.github/actions/setup-cloudsmith-binary/action.yml

@@ -0,0 +1,34 @@
+name: Set up cloudsmith binary
+description: >-
+  Extract the linux-x86_64-gnu cloudsmith binary archive onto the runner and put
+  it on PATH so jobs can dogfood the built CLI.
+
+inputs:
+  version:
+    description: Release version (matches the binaries/cloudsmith-<version>-... archive).
+    required: true
+  add-local-bin:
+    description: Also create ~/.local/bin and add it to PATH (for the docker credential helper launcher).
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        VERSION: ${{ inputs.version }}
+        ADD_LOCAL_BIN: ${{ inputs.add-local-bin }}
+      run: | # zizmor: ignore[github-env]
+        set -euo pipefail
+        ARCHIVE="binaries/cloudsmith-${VERSION}-linux-x86_64-gnu.tar.gz"
+        test -f "${ARCHIVE}"
+        DEST="${RUNNER_TEMP}/cloudsmith-cli"
+        mkdir -p "${DEST}"
+        tar -xzf "${ARCHIVE}" -C "${DEST}"
+        chmod +x "${DEST}/cloudsmith/cloudsmith"
+        echo "${DEST}/cloudsmith" >> "$GITHUB_PATH"
+        if [ "${ADD_LOCAL_BIN}" = "true" ]; then
+          mkdir -p "${HOME}/.local/bin"
+          echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
+        fi

.github/workflows/binaries.yml

@@ -105,9 +105,9 @@ jobs:
         run: |
           MATRIX=$(jq -c . <<'JSON'
           {"include":[
-            {"name":"linux-x86_64-gnu","build_runner":"ubuntu-24.04","mode":"glibc","build_image":"almalinux:8@sha256:4a87d2615a770506e204c27d6248ac97f4df67f4e41e2e9c47c81f0ed0be98cb","test_runner":"ubuntu-24.04","test_kind":"docker","test_images":"debian:11-slim@sha256:ff4b13408ab702565720c6b23582ebda7bfdddfe9ce2b8c5b49e6d40430fdb05 almalinux:8@sha256:4a87d2615a770506e204c27d6248ac97f4df67f4e41e2e9c47c81f0ed0be98cb","archive":".tar.gz"},
+            {"name":"linux-x86_64-gnu","build_runner":"ubuntu-24.04","mode":"glibc","build_image":"almalinux:8@sha256:4a87d2615a770506e204c27d6248ac97f4df67f4e41e2e9c47c81f0ed0be98cb","test_runner":"ubuntu-24.04","test_kind":"docker","test_images":"debian:11-slim@sha256:ff4b13408ab702565720c6b23582ebda7bfdddfe9ce2b8c5b49e6d40430fdb05","archive":".tar.gz"},
             {"name":"linux-x86_64-musl","build_runner":"ubuntu-24.04","mode":"alpine","build_image":"python:3.12-alpine@sha256:dbb1970cc04ce7d381c65efe8309c0c03d463e5b35c88f14d721796ad24cfbfd","test_runner":"ubuntu-24.04","test_kind":"docker","test_images":"alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc","archive":".tar.gz"},
-            {"name":"linux-aarch64-gnu","build_runner":"ubuntu-24.04-arm","mode":"glibc","build_image":"almalinux:8@sha256:4a87d2615a770506e204c27d6248ac97f4df67f4e41e2e9c47c81f0ed0be98cb","test_runner":"ubuntu-24.04-arm","test_kind":"docker","test_images":"debian:11-slim@sha256:ff4b13408ab702565720c6b23582ebda7bfdddfe9ce2b8c5b49e6d40430fdb05 almalinux:8@sha256:4a87d2615a770506e204c27d6248ac97f4df67f4e41e2e9c47c81f0ed0be98cb","archive":".tar.gz"},
+            {"name":"linux-aarch64-gnu","build_runner":"ubuntu-24.04-arm","mode":"glibc","build_image":"almalinux:8@sha256:4a87d2615a770506e204c27d6248ac97f4df67f4e41e2e9c47c81f0ed0be98cb","test_runner":"ubuntu-24.04-arm","test_kind":"docker","test_images":"debian:11-slim@sha256:ff4b13408ab702565720c6b23582ebda7bfdddfe9ce2b8c5b49e6d40430fdb05","archive":".tar.gz"},
             {"name":"linux-aarch64-musl","build_runner":"ubuntu-24.04-arm","mode":"alpine","build_image":"python:3.12-alpine@sha256:dbb1970cc04ce7d381c65efe8309c0c03d463e5b35c88f14d721796ad24cfbfd","test_runner":"ubuntu-24.04-arm","test_kind":"docker","test_images":"alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc","archive":".tar.gz"},
             {"name":"macos-arm64","build_runner":"macos-14","mode":"native","build_image":"","test_runner":"macos-14","test_kind":"macos","test_images":"","archive":".tar.gz"},
             {"name":"macos-x86_64","build_runner":"macos-15-intel","mode":"native","build_image":"","test_runner":"macos-15-intel","test_kind":"macos","test_images":"","archive":".tar.gz"},
@@ -186,15 +186,23 @@ jobs:
               tar -czf "out/${ART}" -C dist cloudsmith
             '
 
+      # Cache pip's download cache only (not site-packages); resolution still runs.
+      - if: matrix.mode == 'glibc'
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ${{ github.workspace }}/.pip-cache
+          key: pip-glibc-${{ matrix.name }}-${{ hashFiles('packaging/constraints.txt', 'uv.lock') }}
+
       - if: matrix.mode == 'glibc'
         env:
           ART: ${{ steps.art.outputs.name }}
           BUILD_IMAGE: ${{ matrix.build_image }}
         run: |
           set -euo pipefail
-          mkdir -p out
+          mkdir -p out .pip-cache
           docker run --rm \
             -e ART="${ART}" \
+            -e PIP_CACHE_DIR=/src/.pip-cache \
             -e PYINSTALLER_CONFIG_DIR=/tmp/pyinstaller \
             -v "${PWD}:/src" -w /src \
             "${BUILD_IMAGE}" bash -c '
@@ -315,7 +323,6 @@ jobs:
         env:
           ART: ${{ steps.art.outputs.name }}
           TEST_IMAGES: ${{ matrix.test_images }}
-          EXPECTED_VERSION: ${{ github.ref_name }}
         run: |
           set -euo pipefail
           EXPECTED_VERSION=$(cat cloudsmith_cli/data/VERSION)

.github/workflows/lint.yml

@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with: