feat: Install the Flagsmith CLI and authenticate it via OIDC

.github/workflows/pull-request.yml

@@ -0,0 +1,29 @@
+name: Pull request
+
+on: pull_request
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npx vitest run
+
+  test-e2e:
+    runs-on: ubuntu-latest
+    environment: test
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./
+        with:
+          api-url: https://api-staging.flagsmith.com
+      - run: flagsmith --version
+      - run: flagsmith flag list --project "Flagsmith/setup-cli E2E" -e E2E

.github/workflows/release.yml

@@ -0,0 +1,25 @@
+name: Update major tag on release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+jobs:
+  major-tag:
+    if: ${{ !github.event.release.prerelease }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - id: get-major-tag
+        run: |
+          major="v${GITHUB_REF_NAME#v}"; major="v${major%%.*}"
+          echo "result=$major" >> "$GITHUB_OUTPUT"
+      - name: Bump ${{ steps.get-major-tag.outputs.result }}
+        run: |
+          # Point the floating major tag at this release
+          # Makes `uses: Flagsmith/setup-cli@v1` work
+          git tag -f "${{ steps.get-major-tag.outputs.result }}" "$GITHUB_REF_NAME"
+          git push -f origin "${{ steps.get-major-tag.outputs.result }}"

.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+lib/
+*.tsbuildinfo

.pre-commit-config.yaml

@@ -0,0 +1,27 @@
+exclude: ^dist/
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: check-yaml
+      - id: check-json
+      - id: check-merge-conflict
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: v3.9.6
+    hooks:
+      - id: prettier
+        types_or: [ts, json, yaml, markdown]
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      - id: actionlint
+
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 0.38.0
+    hooks:
+      - id: check-github-workflows
+      - id: check-renovate

.prettierrc.json

@@ -0,0 +1,4 @@
+{
+  "semi": false,
+  "singleQuote": true
+}

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.0.0"
+}

README.md

@@ -1,2 +1,69 @@
-# setup-cli
-▶️ GitHub Action to download and install the Flagsmith CLI
+# `Flagsmith/setup-cli`
+
+Install the [Flagsmith CLI](https://github.com/Flagsmith/flagsmith-cli) in a GitHub Actions job, and authenticate it without storing a secret.
+
+## Usage
+
+<!-- x-release-please-start-major -->
+
+```yaml
+jobs:
+  flagsmith:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # required for the token exchange
+      contents: read
+    steps:
+      - uses: Flagsmith/setup-cli@v1
+      - run: flagsmith auth status
+```
+
+<!-- x-release-please-end -->
+
+Or, with a static key:
+
+<!-- x-release-please-start-major -->
+
+```yaml
+jobs:
+  flagsmith:
+    runs-on: ubuntu-latest
+    env:
+      FLAGSMITH_API_KEY: ${{ secrets.FLAGSMITH_API_KEY }}
+    steps:
+      # Installs the CLI and skips the token exchange:
+      - uses: Flagsmith/setup-cli@v1
+      - run: flagsmith flags list # uses your key
+```
+
+<!-- x-release-please-end -->
+
+## Inputs
+
+| Input         | Default                     | Description                                                                                            |
+| ------------- | --------------------------- | ------------------------------------------------------------------------------------------------------ |
+| `api-url`     | `https://api.flagsmith.com` | Flagsmith API base URL. Set this for self-hosted instances.                                            |
+| `audience`    | `https://github.com/OWNER`  | The `aud` claim to request. Only set this if your Flagsmith trust relationship uses a custom audience. |
+| `cli-version` | `latest`                    | CLI version to install, e.g. `v2.0.0`.                                                                 |
+
+## When the action skips authentication
+
+The action always installs the CLI, but may skip authentication if:
+
+- the run is a pull request from a fork.
+- the job has no `id-token: write` permission.
+- the job already carries a credential the CLI would use for this `api-url` (`FLAGSMITH_API_KEY` or `FLAGSMITH_ACCESS_TOKEN`, scoped to provided `api-url`).
+
+## After the action runs
+
+The API URL and the exchanged access token are exported to the job environment, where the CLI picks them up.
+
+The CLI binary is added to `PATH` via `GITHUB_PATH`, and cached in the runner tool cache by version and architecture.
+
+## Development
+
+```sh
+npm ci
+npm test        # unit tests
+npm run all     # typecheck, test, and rebuild dist/
+```

action.yml

@@ -0,0 +1,31 @@
+name: Setup Flagsmith CLI
+description: >-
+  Install the Flagsmith CLI and, when the job has an OIDC identity, exchange it
+  for a short-lived Flagsmith access token.
+author: Flagsmith
+branding:
+  icon: flag
+  color: purple
+
+inputs:
+  api-url:
+    description: Flagsmith API base URL.
+    required: false
+    default: https://api.flagsmith.com
+  audience:
+    description: >-
+      The `aud` claim to request for the GitHub OIDC token. Defaults to
+      GitHub's own default, https://github.com/OWNER. Only set this if your
+      Flagsmith trust relationship uses a custom audience.
+    required: false
+    default: ''
+  cli-version:
+    description: >-
+      Version of the CLI to install, e.g. `v2.0.0`. Defaults to the latest
+      release.
+    required: false
+    default: latest
+
+runs:
+  using: node24
+  main: dist/index.cjs