feat: Install the Flagsmith CLI and authenticate it via OIDC

.github/workflows/pull-request.yml

@@ -0,0 +1,15 @@
+name: Pull request
+
+on: pull_request
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npx vitest run

.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+lib/
+*.tsbuildinfo

.pre-commit-config.yaml

@@ -0,0 +1,26 @@
+# These hooks need the repo's npm toolchain, which pre-commit.ci's image does
+# not carry. They run locally; PRs get vitest from pull-request.yml.
+ci:
+  skip: [typecheck, test, dist]
+
+repos:
+  - repo: local
+    hooks:
+      - id: typecheck
+        name: tsc --noEmit
+        entry: npm run typecheck
+        language: system
+        files: \.(ts|json)$
+        pass_filenames: false
+      - id: test
+        name: vitest
+        entry: npx vitest run
+        language: system
+        files: \.ts$
+        pass_filenames: false
+      - id: dist
+        name: dist matches src
+        entry: sh -c 'npm run build >/dev/null 2>&1 && git diff --exit-code dist'
+        language: system
+        files: ^(src/|package\.json|tsconfig\.json)
+        pass_filenames: false

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.0.0"
+}

README.md

@@ -1,2 +1,55 @@
-# setup-cli
-▶️ GitHub Action to download and install the Flagsmith CLI
+# `Flagsmith/setup-cli`
+
+Install the [Flagsmith CLI](https://github.com/Flagsmith/flagsmith-cli) in a GitHub Actions job, and authenticate it without storing a secret.
+
+## Usage
+
+```yaml
+jobs:
+  flagsmith:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # required for the token exchange
+      contents: read
+    steps:
+      - uses: Flagsmith/setup-cli@v1
+      - run: flagsmith auth status
+```
+
+## Inputs
+
+| Input         | Default                     | Description                                                                                                                                                                           |
+| ------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `api-url`     | `https://api.flagsmith.com` | Flagsmith API base URL. Set this for self-hosted instances.                                                                                                                           |
+| `audience`    | GitHub's default            | The `aud` claim to request. GitHub's default is `https://github.com/OWNER`, which is what the GitHub Actions trust relationship form expects. Set it to target a specific `audience`. |
+| `cli-version` | `latest`                    | CLI version to install, e.g. `v2.0.0`.                                                                                                                                                |
+
+## When the action skips authentication
+
+The CLI is always installed. Authentication is skipped, with a warning, when:
+
+- the job has no `id-token: write` permission.
+- the run is a pull request from a fork.
+- the job already carries a credential the CLI would use for this `api-url` (`FLAGSMITH_API_KEY` or `FLAGSMITH_ACCESS_TOKEN`, scoped to provided `api-url`). Bring your own key and the action leaves it alone:
+
+```yaml
+- uses: Flagsmith/setup-cli@v1
+- run: flagsmith auth status
+  env:
+    FLAGSMITH_API_KEY: ${{ secrets.FLAGSMITH_API_KEY }}
+```
+
+## What the action exports
+
+- `FLAGSMITH_API_URL` so later steps talk to the same instance.
+- `FLAGSMITH_ACCESS_TOKEN_<HOST>`  the access token, scoped to the API URL host.
+
+The CLI binary is added to `PATH` via `GITHUB_PATH`, and cached in the runner tool cache by version and architecture.
+
+## Development
+
+```sh
+npm ci
+npm test        # unit tests
+npm run all     # typecheck, test, and rebuild dist/
+```

action.yml

@@ -0,0 +1,32 @@
+name: Setup Flagsmith CLI
+description: >-
+  Install the Flagsmith CLI and, when the job has an OIDC identity, exchange it
+  for a short-lived Flagsmith access token.
+author: Flagsmith
+
+branding:
+  icon: flag
+  color: purple
+
+inputs:
+  api-url:
+    description: Flagsmith API base URL.
+    required: false
+    default: https://api.flagsmith.com
+  audience:
+    description: >-
+      The `aud` claim to request for the GitHub OIDC token. Leave unset to use
+      GitHub's default audience (https://github.com/OWNER). Set it to target a trust
+      relationship configured with a specific audience.
+    required: false
+    default: ""
+  cli-version:
+    description: >-
+      Version of the CLI to install, e.g. `v2.0.0`. Defaults to the latest
+      release.
+    required: false
+    default: latest
+
+runs:
+  using: node24
+  main: dist/index.cjs