From bb039638de66bad0f27ef1ec17ea38485e729a7a Mon Sep 17 00:00:00 2001
From: Ian Duffy <iduffy@cloudsmith.io>
Date: Sun, 16 Aug 2026 20:53:25 +0100
Subject: [PATCH 1/3] chore(ENG-13952): add dev-release workflow for standalone
 binaries

Add a manually dispatched workflow. It builds the standalone binaries
for a branch with the reusable binaries workflow. It publishes them to
the Cloudsmith repository in the CLOUDSMITH_DEV_REPO variable for
manual tests. The job summary lists the download URL and SHA256 for
each target.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/dev-release.yml | 122 ++++++++++++++++++++++++++++++
 1 file changed, 122 insertions(+)
 create mode 100644 .github/workflows/dev-release.yml

diff --git a/.github/workflows/dev-release.yml b/.github/workflows/dev-release.yml
new file mode 100644
index 00000000..a95fde7d
--- /dev/null
+++ b/.github/workflows/dev-release.yml
@@ -0,0 +1,122 @@
+name: Dev Release
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dev-release-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  BINARY_TARGETS: "linux-x86_64-gnu linux-x86_64-musl linux-aarch64-gnu linux-aarch64-musl macos-arm64 macos-x86_64 windows-x86_64"
+
+jobs:
+  binaries:
+    name: Binaries
+    uses: ./.github/workflows/binaries.yml
+    with:
+      online_smoketest: false
+    permissions:
+      contents: read
+      id-token: write
+
+  publish-dev:
+    needs: binaries
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      CLOUDSMITH_NAMESPACE: ${{ vars.CLOUDSMITH_NAMESPACE }}
+      CLOUDSMITH_DEV_REPO: ${{ vars.CLOUDSMITH_DEV_REPO }}
+      CLOUDSMITH_ORG: ${{ vars.CLOUDSMITH_NAMESPACE }}
+      CLOUDSMITH_SERVICE_SLUG: ${{ vars.CLOUDSMITH_SERVICE_SLUG }}
+      BRANCH: ${{ github.ref_name }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - id: version
+        name: Derive the dev build version
+        run: |
+          set -euo pipefail
+          BASE=$(cat cloudsmith_cli/data/VERSION)
+          echo "base=${BASE}" >> "$GITHUB_OUTPUT"
+          echo "dev=${BASE}-dev.${GITHUB_RUN_NUMBER}.g${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: cloudsmith-*
+          merge-multiple: true
+          path: binaries
+
+      - name: Set up the built cloudsmith binary on the runner
+        uses: ./.github/actions/setup-cloudsmith-binary
+        with:
+          version: ${{ steps.version.outputs.base }}
+
+      - name: Pre-authenticate with OIDC
+        run: |
+          set -euo pipefail
+          cloudsmith whoami
+
+      - name: Publish dev binaries
+        env:
+          BASE_VERSION: ${{ steps.version.outputs.base }}
+          DEV_VERSION: ${{ steps.version.outputs.dev }}
+        run: |
+          set -euo pipefail
+          REPO="${CLOUDSMITH_NAMESPACE}/${CLOUDSMITH_DEV_REPO}"
+          BRANCH_TAG=$(printf '%s' "${BRANCH}" | sed 's/[^A-Za-z0-9._-]/-/g' | cut -c1-64)
+          SUMMARY_ROWS=""
+
+          for TARGET in ${BINARY_TARGETS}; do
+            EXT=.tar.gz
+            if [ "${TARGET}" = windows-x86_64 ]; then
+              EXT=.zip
+            fi
+            ARCHIVE="binaries/cloudsmith-${BASE_VERSION}-${TARGET}${EXT}"
+            test -f "${ARCHIVE}"
+            test -f "${ARCHIVE}.sha256"
+
+            OS="${TARGET%%-*}"
+            REST="${TARGET#*-}"
+            case "${OS}" in
+              linux)
+                ARCH="${REST%-*}"
+                LIBC="${REST##*-}"
+                COMMON="${OS},${ARCH},${LIBC},${TARGET}"
+                ;;
+              *)
+                ARCH="${REST}"
+                COMMON="${OS},${ARCH},${TARGET}"
+                ;;
+            esac
+
+            cloudsmith push raw \
+              "${REPO}" \
+              "${ARCHIVE}" \
+              --name "cloudsmith-cli-${TARGET}" \
+              --version "${DEV_VERSION}" \
+              --tags "dev-build,branch-${BRANCH_TAG},${COMMON}" \
+              --republish
+
+            ARCHIVE_BASE="$(basename "${ARCHIVE}")"
+            SHA256="$(awk '{print $1}' "${ARCHIVE}.sha256")"
+            URL="https://dl.cloudsmith.io/public/${REPO}/raw/names/cloudsmith-cli-${TARGET}/versions/${DEV_VERSION}/${ARCHIVE_BASE}"
+            SUMMARY_ROWS="${SUMMARY_ROWS}| ${TARGET} | [${ARCHIVE_BASE}](${URL}) | \`${SHA256}\` |"$'\n'
+          done
+
+          {
+            printf '## Dev build %s\n\n' "${DEV_VERSION}"
+            printf 'Branch `%s` at commit `%s`, published to `%s`.\n\n' \
+              "${BRANCH}" "${GITHUB_SHA}" "${REPO}"
+            printf '| Target | Download | SHA256 |\n'
+            printf '|---|---|---|\n'
+            printf '%s' "${SUMMARY_ROWS}"
+          } >> "$GITHUB_STEP_SUMMARY"

From 3b7476c86e16c7b4455aa39b2ce59af2d4c1099d Mon Sep 17 00:00:00 2001
From: Ian Duffy <iduffy@cloudsmith.io>
Date: Sun, 16 Aug 2026 20:55:10 +0100
Subject: [PATCH 2/3] chore(ENG-13952): add temporary push trigger to test the
 workflow

Revert this commit after the test run passes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/dev-release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/dev-release.yml b/.github/workflows/dev-release.yml
index a95fde7d..9048ae6d 100644
--- a/.github/workflows/dev-release.yml
+++ b/.github/workflows/dev-release.yml
@@ -2,6 +2,9 @@ name: Dev Release
 
 on:
   workflow_dispatch:
+  push:
+    branches:
+      - eng-13952-dev-release-workflow
 
 permissions:
   contents: read

From 72a88cfbb60f21c86b86faf8a3e2fa2847ff869a Mon Sep 17 00:00:00 2001
From: Ian Duffy <iduffy@cloudsmith.io>
Date: Sun, 16 Aug 2026 22:00:06 +0100
Subject: [PATCH 3/3] chore(ENG-13952): derive targets from the matrix and
 verify checksums

Read the target list from binaries-matrix.json so the publish loop
cannot drift from the build matrix. Verify each SHA256 checksum
before the upload.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/dev-release.yml | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/dev-release.yml b/.github/workflows/dev-release.yml
index 9048ae6d..b30dfb49 100644
--- a/.github/workflows/dev-release.yml
+++ b/.github/workflows/dev-release.yml
@@ -13,9 +13,6 @@ concurrency:
   group: dev-release-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  BINARY_TARGETS: "linux-x86_64-gnu linux-x86_64-musl linux-aarch64-gnu linux-aarch64-musl macos-arm64 macos-x86_64 windows-x86_64"
-
 jobs:
   binaries:
     name: Binaries
@@ -78,14 +75,12 @@ jobs:
           BRANCH_TAG=$(printf '%s' "${BRANCH}" | sed 's/[^A-Za-z0-9._-]/-/g' | cut -c1-64)
           SUMMARY_ROWS=""
 
-          for TARGET in ${BINARY_TARGETS}; do
-            EXT=.tar.gz
-            if [ "${TARGET}" = windows-x86_64 ]; then
-              EXT=.zip
-            fi
+          while IFS=$'\t' read -r TARGET EXT; do
             ARCHIVE="binaries/cloudsmith-${BASE_VERSION}-${TARGET}${EXT}"
+            ARCHIVE_BASE="$(basename "${ARCHIVE}")"
             test -f "${ARCHIVE}"
             test -f "${ARCHIVE}.sha256"
+            (cd binaries && sha256sum -c "${ARCHIVE_BASE}.sha256")
 
             OS="${TARGET%%-*}"
             REST="${TARGET#*-}"
@@ -109,11 +104,10 @@ jobs:
               --tags "dev-build,branch-${BRANCH_TAG},${COMMON}" \
               --republish
 
-            ARCHIVE_BASE="$(basename "${ARCHIVE}")"
             SHA256="$(awk '{print $1}' "${ARCHIVE}.sha256")"
             URL="https://dl.cloudsmith.io/public/${REPO}/raw/names/cloudsmith-cli-${TARGET}/versions/${DEV_VERSION}/${ARCHIVE_BASE}"
             SUMMARY_ROWS="${SUMMARY_ROWS}| ${TARGET} | [${ARCHIVE_BASE}](${URL}) | \`${SHA256}\` |"$'\n'
-          done
+          done < <(jq -r '.include[] | [.name, .archive] | @tsv' .github/scripts/binaries-matrix.json)
 
           {
             printf '## Dev build %s\n\n' "${DEV_VERSION}"