Repository navigation
feat(ENG-15089): deprecate cloudsmith login and handle the password login switch-off - #489
Draft
BartoszBlizniak wants to merge 7 commits into
Draft
BartoszBlizniak wants to merge 7 commits into
BartoszBlizniak wants to merge 7 commits into
Conversation
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
Static review identified no blocking issues in the deprecation flow, error handling, or output routing; tests were not executed.
0 open findings
What changed in this PR
Deprecates password-based login without removing working commands, preparing the CLI for the server-side shutdown.
Changes:
- Adds deprecation warnings and actionable messages for 404/410 responses.
- Keeps config messages off JSON stdout and updates authentication hints.
- Adds regression tests and documents API key alternatives.
| File | Description |
|---|---|
| README.md | Documents deprecation and API key alternatives. |
| cloudsmith_cli/core/tests/test_config.py | Tests config output routing in JSON modes. |
| cloudsmith_cli/core/config.py | Routes config prompts and messages to stderr in JSON modes. |
| cloudsmith_cli/cli/tests/test_exceptions.py | Tests updated authentication hints. |
| cloudsmith_cli/cli/tests/commands/test_login.py | Tests warnings, shutdown responses, and JSON output. |
| cloudsmith_cli/cli/exceptions.py | Updates login and authentication error hints. |
| cloudsmith_cli/cli/commands/login.py | Adds warnings and handles endpoint shutdown responses. |
| CHANGELOG.md | Records deprecation and output fixes. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
`cloudsmith login` and its `cloudsmith token` alias now print a deprecation warning on stderr before they prompt for credentials. The commands keep working until username and password login is disabled. The warning points users at getting an API key from the web app and at `cloudsmith auth`. The 401 hint for users with no credentials no longer recommends `cloudsmith token`, and the failed-login hint now covers the `login` name as well as `token`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…clean When the API returns 410 (or 404 once the route is removed), `cloudsmith login` and `cloudsmith token` explain that username and password login is disabled and how to get an API key, instead of the raw error. Other errors, such as outages or wrong credentials, keep the standard rendering. Config file prompts and messages from `create_config_files` and `new_config_messaging` now go to stderr for JSON output, so `login -F json` and `--save-config` with JSON output produce parseable stdout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… date The warning, help text, CHANGELOG and README say the commands stop working when username and password login is disabled, and that the date will be announced in the public changelog. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The deprecation warning uses a `Warning:` prefix and names the replacement. - The disabled-login error states what failed and adds a `Fix:` line with the exact command. - Use "API key" consistently, and stop telling users to "try again" in the 401 hints. The success output (`Your API key/token is: ...`) is unchanged so that scripts parsing it keep working. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The deprecation warning, the disabled-login error and `--help` now end with a `More:` line linking to the CLI docs section on getting an API key. The SSO fix names the exact command, `cloudsmith auth --workspace <workspace>`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
BartoszBlizniak
force-pushed
the
eng-15089-cli-deprecate-cloudsmith-login-usernamepassword-flow
branch
from
October 16, 2026 14:51
7800fe7 to
2c8e02b
Compare
Keep this change to the login deprecation. Routing config file prompts and messages to stderr for JSON output is a separate fix, so restore `core/config.py` and its tests, and drop the CHANGELOG entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…sernamepassword-flow
2 of 6 tasks
cloudsmith-iduffy
approved these changes
Oct 16, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Cloudsmith is disabling username and password login (
POST /v1/user/token/), whichcloudsmith loginand itscloudsmith tokenalias depend on.410(or404after the route is deleted), they fail with a clear message and the same fix, instead of a raw error. Other errors, such as outages, are unchanged.cloudsmith token.Type of Change
Additional Notes
This deprecates the commands instead of removing them (#447), since they still work today. Because the CLI reacts to the server's response, it needs no further release when the endpoint is disabled. #447 can follow as cleanup.
To try the switch-off path, point
--api-hostat any server that answersPOST /user/token/with a 410.The live integration job fails here and on master until #490 merges.
🤖 Generated with Claude Code