feat: Integrate SSO renewal with credential resolution

[cloudsmith-iduffy]

Summary

• integrate the core SSO renewal result API into keyring credential resolution
• retain usable SSO tokens on transient renewal failures while rejecting dead sessions and continuing the provider chain
• skip automatic renewal for authentication commands and emit precise fallback warnings without introducing early CLI errors

Testing

• pytest -q cloudsmith_cli/core/tests/test_keyring_provider.py cloudsmith_cli/cli/tests/test_decorators.py
• pre-commit run --files cloudsmith_cli/core/credentials/models.py cloudsmith_cli/core/credentials/providers/keyring_provider.py cloudsmith_cli/cli/decorators.py cloudsmith_cli/core/tests/test_keyring_provider.py cloudsmith_cli/cli/tests/test_decorators.py

Stacked on #407.

[cloudsmith-iduffy]

@copilot resolve all conflicts

[Copilot]

Pull request overview

This PR integrates the centralized SSO renewal outcome API into the keyring credential provider flow, so credential resolution can preserve still-valid SSO access tokens on transient renewal failures while cleanly falling back (or continuing unauthenticated) on rejected/expired sessions, and it suppresses automatic renewal during auth-related commands.

Changes:

• Refactors KeyringProvider to use renew_sso_session() and map renewal outcomes into explicit CredentialContext flags.
• Extends CredentialContext with additional SSO-renewal outcome fields plus a skip_keyring_refresh switch.
• Updates CLI credential resolution to skip auto-renewal for auth commands and emit more granular fallback warnings; adds/updates tests for these behaviors.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
cloudsmith_cli/core/credentials/providers/keyring_provider.py	Switches keyring refresh logic to the centralized SSO renewal result API and maps outcomes to context flags.
cloudsmith_cli/core/credentials/models.py	Adds context flags for rejected/unrenewable refresh outcomes and a skip_keyring_refresh control.
cloudsmith_cli/cli/decorators.py	Propagates skip_keyring_refresh for auth commands and refines stderr fallback warnings based on renewal outcomes.
cloudsmith_cli/core/tests/test_keyring_provider.py	Updates unit tests to cover renewed/current/unrenewable/rejected renewal behaviors in keyring resolution.
cloudsmith_cli/cli/tests/test_decorators.py	Adds tests ensuring rejected sessions don’t cause early CLI failures and auth commands skip auto refresh.

Suppressed comments (4)

cloudsmith_cli/core/tests/test_keyring_provider.py:74

• Use the SsoRenewalStatus enum rather than a string literal for the renewal status to avoid silent typos.

        renewal = SsoRenewalResult(status="renewed", access_token="new-token")

cloudsmith_cli/core/tests/test_keyring_provider.py:114

• Use the SsoRenewalStatus enum rather than a string literal for the renewal status to avoid silent typos.

        renewal = SsoRenewalResult(
            status="current",
            access_token="old-token",
            error=error,
        )

cloudsmith_cli/core/tests/test_keyring_provider.py:133

• Use the SsoRenewalStatus enum rather than a string literal for the renewal status to avoid silent typos.

        renewal = SsoRenewalResult(
            status="unrenewable",
            access_token="old-token",
        )

cloudsmith_cli/core/tests/test_keyring_provider.py:150

• Use the SsoRenewalStatus enum rather than a string literal for the renewal status to avoid silent typos.

        renewal = SsoRenewalResult(status="rejected")

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

@copilot resolve all conflicts

No new commit was needed: current HEAD 20e718b already contains cloudsmith-iduffy-harden-sso-renewal at fd9a17a, and a local git merge origin/cloudsmith-iduffy-harden-sso-renewal reports Already up to date.