fix(review): address PR #319 review feedback

- setup-cloudsmith-binary: verify the .sha256 checksum before extracting
  the archive onto PATH, so a corrupted/unexpected artifact is never
  executed (the .sha256 is already downloaded alongside the archive).
- release.yml: document at the binaries call site that publishing is
  OIDC-only and the API key secret is required solely for the read-only
  online smoketest (fail-fast when online_smoketest is requested); the
  OIDC online path is covered by the binaries `oidc` job.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: BartoszBlizniak

.github/actions/setup-cloudsmith-binary/action.yml

@@ -23,6 +23,10 @@ runs:
         set -euo pipefail
         ARCHIVE="binaries/cloudsmith-${VERSION}-linux-x86_64-gnu.tar.gz"
         test -f "${ARCHIVE}"
+        # Verify the accompanying checksum before extracting onto PATH so a
+        # corrupted or unexpected artifact never gets executed.
+        test -f "${ARCHIVE}.sha256"
+        ( cd binaries && sha256sum -c "$(basename "${ARCHIVE}").sha256" )
         DEST="${RUNNER_TEMP}/cloudsmith-cli"
         mkdir -p "${DEST}"
         tar -xzf "${ARCHIVE}" -C "${DEST}"

.github/workflows/release.yml

@@ -38,6 +38,10 @@ jobs:
     name: Binaries
     needs: validate
     uses: ./.github/workflows/binaries.yml
+    # Publishing authenticates via OIDC (no API key). The online smoketest is a
+    # separate read-only check that does still need CLOUDSMITH_API_KEY: with
+    # online_smoketest: true the reusable workflow fails fast if it is missing.
+    # The OIDC online path is covered separately by the binaries `oidc` job.
     with:
       online_smoketest: true
     permissions: