feat(ENG-13678): adding cargo credential helper to cli

[coillteoir]

No description provided.

[Copilot]

Pull request overview

Adds first-class Cargo credential-provider support to the Cloudsmith CLI credential-helper suite, including installer/uninstaller wiring and a runtime that speaks Cargo’s line-delimited JSON protocol. It also generalizes the existing JSON config-merge helper to support TOML so Cargo’s config.toml can be patched safely via the same atomic write/backup mechanism.

Changes:

• Introduces a Cargo credential-provider runtime (hello + request loop) and an installer that writes a cargo-credential-cloudsmith launcher and updates $CARGO_HOME/config.toml.
• Extends core.cache_utils from JSON-only merging to merge_config_file(..., format="json"|"toml"), and updates Docker installer + tests to use the renamed function.
• Adds test coverage for the Cargo credential helper (CLI wiring, runtime protocol behavior, installer behavior) and minor test refactors/cleanups elsewhere.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
uv.lock	Locks the new toml dependency.
pyproject.toml	Adds toml>=0.10.2 as a runtime dependency.
cloudsmith_cli/credential_helpers/docker/installer.py	Switches to merge_config_file (renamed/generalized config merge helper).
cloudsmith_cli/credential_helpers/cargo/runtime.py	Implements Cargo credential-provider protocol runtime (stdin/stdout JSON conversation).
cloudsmith_cli/credential_helpers/cargo/installer.py	Installs/uninstalls the Cargo provider launcher and patches Cargo config.toml.
cloudsmith_cli/credential_helpers/cargo/init.py	Exposes Cargo helper runtime entry points.
cloudsmith_cli/core/cache_utils.py	Generalizes config merging to support JSON + TOML and renames function to merge_config_file.
cloudsmith_cli/core/tests/test_cache_utils.py	Updates tests to use merge_config_file (JSON mode).
cloudsmith_cli/core/tests/test_aws_detector.py	Refactors nested mocks to a single with (...) block.
cloudsmith_cli/cli/tests/test_startup_imports.py	Makes subprocess.run non-raising and asserts on return code.
cloudsmith_cli/cli/tests/test_push.py	Refactors nested context managers into with (...).
cloudsmith_cli/cli/tests/test_exceptions.py	Removes an extra blank line.
cloudsmith_cli/cli/tests/test_credential_helper_cargo.py	Adds comprehensive tests for Cargo helper runtime, CLI command, and installer/uninstaller.
cloudsmith_cli/cli/commands/credential_helper/manage.py	Registers Cargo installer in the credential-helper manager.
cloudsmith_cli/cli/commands/credential_helper/cargo.py	Adds cloudsmith credential-helper cargo command implementing the Cargo protocol shim.
cloudsmith_cli/cli/commands/credential_helper/init.py	Registers the new Cargo subcommand under credential-helper.
CHANGELOG.md	Documents the new Cargo credential provider feature and usage.

Suppressed comments (1)

cloudsmith_cli/core/cache_utils.py:62

• The merge_config_file docstring still describes this helper as JSON-only (and the path param example is JSON-specific), but the function now supports TOML as well. Updating the docstring avoids misleading future callers.

    """Read a JSON object file, apply *mutate* in place, and atomically write it back.

    Parameters
    ----------
    path:

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 17 changed files in this pull request and generated 6 comments.

[tigh-latte]

v good stuff, I've spotted nothing that copilot hasn't already

[coillteoir]

v good stuff, I've spotted nothing that copilot hasn't already

Thanks! Working through copilot issues, and will run another pass

[Copilot]

Pull request overview

Copilot reviewed 16 out of 17 changed files in this pull request and generated 2 comments.

Suppressed comments (2)

cloudsmith_cli/credential_helpers/cargo/installer.py:121

• Pinning every matching named registry here removes the cargo:token fallback that the global list deliberately preserves. A per-registry credential-provider shadows registry.global-credential-providers, so when the Cloudsmith helper returns not-found, an existing token in credentials.toml is no longer tried; this also overwrites any user-selected per-registry provider. Register the helper globally and avoid writing this singular per-registry setting, or preserve an equivalent fallback without clobbering user configuration.

        # A per-registry `credential-provider` shadows the global list, so pin
        # ours on any registry whose index is a known Cloudsmith Cargo host.
        for _name, entry in self._cloudsmith_registries(config, hosts):
            entry["credential-provider"] = self.PROVIDER_VALUE

cloudsmith_cli/core/cache_utils.py:146

• Serializing the parsed Cargo config with toml.dumps rewrites the entire file and drops all user comments, even though this operation only intends to add one provider entry. Installing the helper therefore causes irreversible content loss in the active config.toml (the backup does not preserve it in place). Use a round-trip TOML parser such as tomlkit and mutate its document model so unrelated formatting and comments survive.

    elif format == "toml":
        new_text = toml.dumps(data)

[cloudsmith-iduffy]

Looks good! took it for a spin on one of our internal rust projects and credentials resolved as expected. I kicked off https://github.com/cloudsmith-io/cloudsmith-cli/actions/runs/32853891342 on your branch to have publicly accessible binaries to see how the helper would get on in some pre-existing CI flow.