Integrations

Integrating GCP CloudBuild

Cloudsmith can be used as a target for all the assets created using Google CloudBuild. This guide shows you how to use the Cloudsmith CLI to upload/push a Python package to your Cloudsmith repo.

All formats are supported.

Getting started

Integrating Cloudsmith as part of your Google CloudBuild project is as simple as installing the Cloudsmith CLI during your build and then using the cloudsmith push command to upload the artifacts from your build process to your Cloudsmith repository.

Adding your API key to Google Cloud

In order to use the Cloudsmith CLI with Google CloudBuild, we recommend you to create a Cloudsmith service account and use its API key instead of a personal API key. This is more secure, easier to audit, and better suited for CI/CD environments like Google CloudBuild.

Once you’ve created a service account and generated its API key, we recommend that you add the key as an environment variable using Google Secret Manager.

Note

📘 Authentication best practices

We do not recommend adding the API-Key itself directly into the cloudbuild.yaml file for your Google CloudBuild project, as it will then be revealed in any resulting logs from the build.

Step 1: store the API key in Google Secret Manager

1. Go to the Secret Manager page in the Google Cloud Console.
2. Click + CREATE SECRET.
3. In the Name field, enter CLOUDSMITH_API_KEY.
4. In the Secret value field, paste your Cloudsmith service account API key.
5. Leave other settings as default or configure as needed.
6. Click CREATE SECRET.

Step 2: grant Cloud Build access to the secret

Your Cloud Build service account (usually [PROJECT_NUMBER]@cloudbuild.gserviceaccount.com) needs permission to access the secret.

1. Go to the Secret Manager page.
2. Click on the CLOUDSMITH_API_KEY secret.
3. Go to the PERMISSIONS tab.
4. Click + GRANT ACCESS.
5. In New principals, enter your Cloud Build service account.
6. Under Select a role, choose Secret Manager Secret Accessor.
7. Click SAVE.

Step 3: reference the secret in cloudbuild.yaml

To reference a secret stored in Google Secrets Manager in your Google CloudBuild cloudbuild.yaml file you would use the following syntax:

steps:
  - name: 'python'
    secretEnv: ['CLOUDSMITH_API_KEY']

For further details on using Google Secrets Manager with Google CloudBuild see Use secrets from Secret Manager.

Alternatively, you can authenticate without a stored API key by using OpenID Connect (OIDC). Set the CLOUDSMITH_OIDC_TOKEN, CLOUDSMITH_ORG, and CLOUDSMITH_SERVICE_SLUG environment variables and the CLI automatically exchanges the OIDC token for a short-lived Cloudsmith token. See OpenID Connect for provider setup.

Adding the Cloudsmith CLI to your CloudBuild project

The Cloudsmith CLI ships as a standalone binary, so no Python or other runtime is required for the CLI itself. To add the Cloudsmith CLI to your Google CloudBuild Project, add a build step to the cloudbuild.yaml file that runs the install script. The install script prints the installation result as key=value lines; the step below parses bin_dir from that output and adds it to PATH:

steps:
  - name: 'python'
    entrypoint: bash
    args:
      - '-c'
      - |
        set -eu
        apt-get update && apt-get install -y ca-certificates curl
        install_output="$(curl -fsSL https://install.cloudsmith.com/raw/versions/latest/cli.sh | sh -s -- --version 1.20.1)"
        bin_dir="$(printf '%s\n' "$install_output" | sed -n 's/^bin_dir=//p')"
        export PATH="$bin_dir:$PATH"

Uploading a built artifact to Cloudsmith

To upload an artifact from a build to a Cloudsmith repository, add the cloudsmith push command to the same build step:

        cloudsmith push FORMAT WORKSPACE/REPOSITORY FILENAME

Please see the Cloudsmith CLI documentation for more details of the syntax of the cloudsmith push command and the Supported Formats page for examples of the cloudsmith push command for each supported format.

Example cloudbuild.yaml

Here’s a complete working example that builds a Python package and uploads it to a Cloudsmith repository:

steps:

  - name: 'python'
    entrypoint: bash
    secretEnv: ['CLOUDSMITH_API_KEY']
    args:
      - '-c'
      - |
        set -eu
        echo "Installing Cloudsmith CLI..."
        apt-get update && apt-get install -y ca-certificates curl
        install_output="$(curl -fsSL https://install.cloudsmith.com/raw/versions/latest/cli.sh | sh -s -- --version 1.20.1)"
        bin_dir="$(printf '%s\n' "$install_output" | sed -n 's/^bin_dir=//p')"
        export PATH="$bin_dir:$PATH"

        echo "Setting up virtualenv..."
        python3 -m venv venv
        source venv/bin/activate
        pip install --upgrade pip setuptools wheel

        echo "Building package..."
        python setup.py sdist bdist_wheel

        echo "Authenticating with Cloudsmith..."
        cloudsmith whoami 

        echo "Pushing package to Cloudsmith..."
        cloudsmith push python WORKSPACE/REPOSITORY dist/*.whl

availableSecrets:
  secretManager:
    - versionName: projects/your-gcp-project-id/secrets/CLOUDSMITH_API_KEY/versions/latest
      env: CLOUDSMITH_API_KEY

Note

📘 Replace WORKSPACE/REPOSITORY with your actual Cloudsmith Workspace and repository slugs.

Also update your-gcp-project-id with your actual Google Cloud project ID.

Support

As always, if you have any questions about integration or would like some general advice, please contact support.

Updated 2 weeks ago