From 4a9bc043d238c0c7139c11c65aae6d057345f65e Mon Sep 17 00:00:00 2001 From: Ian Duffy Date: Thu, 10 Sep 2026 16:13:48 +0100 Subject: [PATCH 1/2] release: v3.1.1 Record the sequential OIDC credential fix in the changelog. Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 12f7b15..601ce98 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] --- +## [3.1.1] - 2026-09-10 +--- +### Fixed + +- `export-auth-token` with OIDC: a second invocation of the action no longer reuses the token that an earlier invocation exported. The credential helper inherited `CLOUDSMITH_API_KEY` from the environment and returned it unchanged, so setup for a second organization kept the first organization's credential. The wrapper scripts now clear the inherited `CLOUDSMITH_API_KEY` before they call the helper. An explicit `api-key` input is still honoured. + ## [3.1.0] - 2026-08-03 --- ### Added From aa3ff50758a21cc9bd8c10e707d08d7b050e1261 Mon Sep 17 00:00:00 2001 From: Ian Duffy Date: Thu, 10 Sep 2026 16:16:29 +0100 Subject: [PATCH 2/2] Fix token reuse in `export-auth-token` action Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 601ce98..e6e08bf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,7 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 --- ### Fixed -- `export-auth-token` with OIDC: a second invocation of the action no longer reuses the token that an earlier invocation exported. The credential helper inherited `CLOUDSMITH_API_KEY` from the environment and returned it unchanged, so setup for a second organization kept the first organization's credential. The wrapper scripts now clear the inherited `CLOUDSMITH_API_KEY` before they call the helper. An explicit `api-key` input is still honoured. +- `export-auth-token` with OIDC: a second invocation of the action no longer reuses the token that an earlier invocation exported. The credential helper inherited `CLOUDSMITH_API_KEY` from the environment and returned it unchanged, so setup for a second organization kept the first organization's credential. The wrapper scripts now clear the inherited `CLOUDSMITH_API_KEY` before they call the helper. An explicit `api-key` input is still honored. ## [3.1.0] - 2026-08-03 ---