feat: add CLOUDSMITH_KEYRING_FILE_PATH and CLOUDSMITH_KEYRING_DIR for keyring file placement

[cloudsmith-iduffy]

Description

Why: We were previously using XDG_DATA_HOME to route where the keyring token files get written. That quickly led to conflicts and unintended consequences for other tools — the variable relocates data for every XDG-aware application in the environment, not just the CLI.

What: Introduce CLOUDSMITH_-prefixed env vars for better scoped control over keyring file placement, extending the pattern from #356 (CLOUDSMITH_KEYRING_BACKEND, CLOUDSMITH_KEYRING_KEY). Two new variables, in priority order:

1. CLOUDSMITH_KEYRING_FILE_PATH — the exact storage file. Aliases the keyring library's native KEYRING_PROPERTY_FILE_PATH, which takes precedence if both are set (same rule as the fix: add CLOUDSMITH_KEYRING_* env var aliases to avoid global impact #356 aliases).
2. CLOUDSMITH_KEYRING_DIR — a storage directory; the backend keeps its default filename (e.g. cryptfile_pass.cfg). Ignored when either file path variable is set, and a no-op for backends that don't store to a file (e.g. macOS Keychain).

With neither set, behaviour is unchanged. ~ and $VARS are expanded in both. Parent directories are created by the backends' own _ensure_file_path() on first write. Everything is applied in _prepare_keyring_backend(), so all keyring entry points (get/set/delete) resolve paths identically.

Examples:

export CLOUDSMITH_KEYRING_FILE_PATH=/secure/path/cloudsmith-keyring.cfg
# or
export CLOUDSMITH_KEYRING_DIR=/secure/path

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

Verified end-to-end with keyrings.alt.file.PlaintextKeyring: with CLOUDSMITH_KEYRING_DIR set, the token file lands at <dir>/keyring_pass.cfg; with CLOUDSMITH_KEYRING_FILE_PATH set, it lands at the exact path, and stored tokens read back correctly. Unit tests cover the precedence matrix (native over alias, file path over dir), expansion, and the non-file-backend no-op.

[Copilot]

Pull request overview

Adds Cloudsmith-scoped environment variables to control where file-based keyring backends store tokens, avoiding the global side effects of XDG_DATA_HOME and aligning with the existing CLOUDSMITH_KEYRING_* alias pattern.

Changes:

• Introduces CLOUDSMITH_KEYRING_FILE_PATH as an alias for KEYRING_PROPERTY_FILE_PATH, with ~/env-var expansion and native-var precedence.
• Adds CLOUDSMITH_KEYRING_DIR support to redirect file-backed keyring backends to a chosen directory while preserving each backend’s default filename.
• Extends the keyring unit tests and documents the new env vars in the changelog.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
cloudsmith_cli/core/keyring.py	Adds path expansion + env var syncing and applies CLOUDSMITH_KEYRING_DIR to file-backed keyring backends.
cloudsmith_cli/core/tests/test_keyring.py	Adds coverage for new env var precedence/expansion and directory behavior.
CHANGELOG.md	Documents the new keyring env vars and their precedence/behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.