feat(no-ticket): get Workspace domains from the v2 API by cloudsmith-iduffy · Pull Request #476 · cloudsmith-io/cloudsmith-cli

cloudsmith-iduffy · 2026-10-12T20:31:09Z

Description

The CLI kept its own table of Cloudsmith hostnames, which pinned it to production. It now gets the domains of a Workspace from the configured API host with GET /v2/workspaces/{workspace}/domains/. The answer holds the Cloudsmith-owned hosts and the custom domains, in preference order.

domains list keeps its version 1 JSON shape. primary and created_at are now null, because the API does not give them.
Without a Workspace, domains list uses cached domains, or the domains of a Workspace that the credential is a member of.
The credential helpers and their installers use the same domains. The installers use their built-in default host only when they cannot get the domains from the API.
The domain cache is kept per API base URL.
The built-in table (default_domains.py) and the [domains] section in config.ini are removed. custom_domains.py becomes domains.py.

Type of Change

Additional Notes

Tested end to end on production, without changes to the consumers: pip through cloudsmith-keyring, a Maven build through cloudsmith-maven-tools, and terraform init through the Terraform helper. Each authenticated on Cloudsmith-owned hosts and on custom domains. A second API host returned its own hosts only.

The [domains] section in the cloudsmith-docs CLI page needs removing after release.

🤖 Generated with Claude Code

Copilot

🟡 Changes recommended

Cache partitioning and redirect handling can allow credentials to cross API deployment boundaries.

2 open findings

What changed in this PR

Moves Workspace domain discovery to the configured v2 API, replacing production-specific domain tables.

Changes:

Adds a shared v2 client and paginated Workspace-domain API.
Introduces per-API-host domain caching and JSON output version 2.
Updates credential helpers, tests, dependencies, and documentation.

File	Description
`uv.lock`	Locks `cloudsmith-api` 2.0.38.
`pyproject.toml`	Raises the minimum SDK version.
`cloudsmith_cli/credential_helpers/workspace_domains.py`	Implements domain parsing and caching.
`cloudsmith_cli/credential_helpers/pnpm/installer.py`	Uses Workspace discovery.
`cloudsmith_cli/credential_helpers/docker/installer.py`	Uses Workspace discovery.
`cloudsmith_cli/credential_helpers/default_domains.py`	Removes the built-in domain table.
`cloudsmith_cli/credential_helpers/custom_domains.py`	Removes legacy custom-domain discovery.
`cloudsmith_cli/credential_helpers/common.py`	Validates hosts against Workspace domains.
`cloudsmith_cli/credential_helpers/cargo/installer.py`	Uses Workspace discovery.
`cloudsmith_cli/core/tests/test_workspaces.py`	Tests v2 domain requests and pagination.
`cloudsmith_cli/core/api/workspaces.py`	Adds the Workspace domains API wrapper.
`cloudsmith_cli/core/api/v2.py`	Adds the shared v2 HTTP client.
`cloudsmith_cli/core/api/orgs.py`	Removes the legacy domains call.
`cloudsmith_cli/core/api/metadata.py`	Migrates metadata calls to the v2 client.
`cloudsmith_cli/cli/tests/commands/test_workspace_domains.py`	Tests domain parsing and cache isolation.
`cloudsmith_cli/cli/tests/commands/test_domains.py`	Updates command behavior tests.
`cloudsmith_cli/cli/tests/commands/test_default_domains.py`	Removes obsolete table tests.
`cloudsmith_cli/cli/tests/commands/test_custom_domain_precedence.py`	Removes client-side precedence tests.
`cloudsmith_cli/cli/tests/commands/test_credential_helper.py`	Updates helper discovery tests.
`cloudsmith_cli/cli/tests/commands/test_credential_helper_install.py`	Updates installer cache tests.
`cloudsmith_cli/cli/commands/domains.py`	Emits API-supplied domains using schema v2.
`CHANGELOG.md`	Documents the breaking behavior changes.
`.oss-scanner/threat_model.md`	Updates the security-sensitive module path.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

cloudsmith-iduffy · 2026-10-14T09:42:32Z

@copilot Can you modify my change so that its not a breaking change? perhaps we can introduce something like a --version 2 flag and introduce a notice for no flag being specified to say it will eventually be like --version 2 ?

Copilot · 2026-10-14T09:51:32Z

@copilot Can you modify my change so that its not a breaking change? perhaps we can introduce something like a --version 2 flag and introduce a notice for no flag being specified to say it...

Implemented in 92ffe0c (test cleanup in 7c92e81).

No flag keeps version 1 behavior and prints a future-default notice to stderr; JSON stdout stays unchanged.
--version 1 pins existing behavior without the notice.
--version 2 opts into API-driven discovery and the new JSON schema.
Existing [domains] configuration and credential-helper behavior remain supported.

1,547 non-integration tests passed; hooks passed and CodeQL reports no alerts. Existing repository-wide type-check diagnostics remain.

cloudsmith-iduffy · 2026-10-14T21:11:29Z

@copilot can we modify the v1 behaviour slightly? Use the new api but keep the same format adding null fields if the data isn't available.

Copilot · 2026-10-14T21:19:39Z

@copilot can we modify the v1 behaviour slightly? Use the new api but keep the same format adding null fields if the data isn't available.

Implemented in 7c12c8c.

Default output and --version 1 now use the Workspace domains API, retaining the v1 JSON fields with primary and created_at set to null.
Both versions preserve API ordering; v2 and the default-version notice remain unchanged.
Both now use cached domains only without a Workspace and ignore [domains] overrides. Credential helpers are unchanged.

1,552 non-integration tests passed, along with hooks and command type checking. CodeQL reports no alerts.

cloudsmith-iduffy · 2026-10-15T15:46:37Z

I squashed the branch into one commit on top of master and removed the --version option. domains list now always writes version 1, with the same fields as before. The API does not give primary and created_at, so they are null. The credential helpers now also use the Workspace domains API, so the CLI has no hostname table. The description lists the consumer checks.

Copilot

🔵 Needs a closer look

Credential-trusted domain changes need human validation, and Terraform token compatibility remains unresolved for alternate deployments.

1 open finding

Use discovered domain scope for GLOBAL Terraform token format · New

2 resolved since last review

🧠 Review effort: Balanced

Copilot

🟡 Changes recommended

A failed uncached Terraform ownership lookup can return an incorrectly scoped token while reporting success.

1 open finding

Avoid treating failed domain cache lookup as a custom domain · New

1 resolved since last review

Use discovered domain scope for GLOBAL Terraform token format

🧠 Review effort: Balanced

Copilot

🟡 Changes recommended

An omitted API host can cache another deployment’s domains under production, compromising credential isolation.

1 open finding

Use the configured API host when caching workspace domains · New

1 resolved since last review

Avoid treating failed domain cache lookup as a custom domain

🧠 Review effort: Balanced

Copilot

🔵 Needs a closer look

Changes to credential-host discovery and Terraform token scoping warrant final human validation.

0 open findings

1 resolved since last review

Use the configured API host when caching workspace domains

🧠 Review effort: Balanced

Copilot

🔵 Needs a closer look

Domain discovery governs credential release, so the API-contract and cache-isolation changes warrant final human security review.

0 open findings

🧠 Review effort: Balanced

The CLI kept a table of Cloudsmith hostnames. That table pinned the CLI to the production hosts. The CLI now gets the domains of a Workspace from GET /v2/workspaces/{workspace}/domains/ on the configured API host. The answer includes the Cloudsmith-owned hosts, in preference order. - Remove the built-in hostname table and the [domains] section in config.ini. - Keep version 1 of the domains list JSON document. Set primary and created_at to null, because the API does not give them. - Without a Workspace, domains list uses the cached domains. If no domains are cached, it gets the domains of a Workspace that the credential is a member of. - Name the domain cache after the full API base URL, so two deployments on one hostname do not share a cache. - Put the org in the Terraform token for every host that the API lists as Cloudsmith-owned, not only for *.cloudsmith.io hosts. - Make the credential helper installers configure the Cloudsmith-owned hosts that the API lists. They use their default host only when they cannot get the domains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cloudsmith-iduffy requested review from a team and cloudsmith-bot as code owners October 12, 2026 20:31

Copilot AI balanced review requested due to automatic review settings October 12, 2026 20:31

Copilot started reviewing on behalf of cloudsmith-iduffy October 12, 2026 20:31

View session

github-advanced-security Bot found potential problems Oct 12, 2026

View reviewed changes

Comment thread cloudsmith_cli/cli/tests/commands/test_domains.py Fixed

Comment thread cloudsmith_cli/cli/tests/commands/test_domains.py Fixed

Copilot AI reviewed Oct 12, 2026

View reviewed changes

Comment thread cloudsmith_cli/core/api/v2.py Outdated

Comment thread cloudsmith_cli/credential_helpers/workspace_domains.py Outdated

cloudsmith-iduffy force-pushed the iduffy/v2-workspace-domains branch 4 times, most recently from 4e43950 to 47f388b Compare October 12, 2026 20:59

cloudsmith-iduffy changed the base branch from master to iduffy/shared-v2-client October 12, 2026 20:59

cloudsmith-iduffy added this pull request to stack #479 October 12, 2026 20:59

cloudsmith-iduffy marked this pull request as draft October 12, 2026 21:01

cloudsmith-iduffy force-pushed the iduffy/v2-workspace-domains branch from 47f388b to 68a1c40 Compare October 13, 2026 13:47

Copilot started work on behalf of cloudsmith-iduffy October 14, 2026 09:43

View session

Copilot finished work on behalf of cloudsmith-iduffy October 14, 2026 09:52

Copilot started work on behalf of cloudsmith-iduffy October 14, 2026 21:12

View session

Copilot finished work on behalf of cloudsmith-iduffy October 14, 2026 21:20

cloudsmith-iduffy force-pushed the iduffy/v2-workspace-domains branch from 7c12c8c to 5378e7a Compare October 14, 2026 23:07

Base automatically changed from iduffy/shared-v2-client to master October 14, 2026 23:30

cloudsmith-iduffy force-pushed the iduffy/v2-workspace-domains branch from 5378e7a to bc2f866 Compare October 15, 2026 15:45

cloudsmith-iduffy requested a balanced review from Copilot October 15, 2026 15:46

Copilot started reviewing on behalf of cloudsmith-iduffy October 15, 2026 15:47

View session