OpenID Connect (OIDC) provides ephemeral tokens, reducing the risk of long-lived credentials being exposed. For many organizations, artifact management tokens are among the most widely used credentials, making them a significant target for security breaches.

Shifting to OIDC is an excellent way to strengthen security posture, offering substantial benefits with minimal implementation effort. While direct 

Dependabot integration with OIDC in GitHub Actions isn’t available

, API-based token rotation offers a reliable workaround.

This guide will walk you through configuring GitHub Dependabot to authenticate with Cloudsmith using OIDC. It includes steps for setting up a Cloudsmith service account, configuring OIDC in Cloudsmith, setting up GitHub permissions, and creating a GitHub Actions workflow to dynamically update the Dependabot API key.

Step 1: Create a Service Account in Cloudsmith

 that the service account should be associated with for broader permissions.

Step 2: Configure OIDC Authentication for GitHub Actions in Cloudsmith

: Enter a descriptive name (e.g., GitHub Actions).

: Enter https://token.actions.githubusercontent.com.

 as the required claim for GitHub OIDC tokens to restrict access to your specific GitHub organization.

, select the service account created in Step 1 (Dependabot Service Account).

OIDC setup with GitHub Actions in Cloudsmith

Step 3: Set Up Access Controls in Cloudsmith

 for the repository where you want Dependabot to manage dependencies.

Step 4: Add a Fine-Grained Personal Access Token (PAT) in GitHub for Dependabot

 to the specific repository where you want to use Dependabot.

Add a new secret with the name FINE_GRAINED_PAT and paste the PAT as the value.

Step 5: Create DEP_CLOUDSMITH_API_KEY Secret for Dependabot

, enter a placeholder value (e.g., INITIAL_VALUE or a temporary token from Cloudsmith).

This sets up DEP_CLOUDSMITH_API_KEY as a Dependabot-compatible secret so that the GitHub Action can later overwrite it with an ephemeral OIDC token each time it runs.

The initial value doesn’t need to be valid long-term, as it will be regularly replaced by the OIDC-generated token.

After this initial setup, the GitHub Actions workflow you configured will take over, updating DEP_CLOUDSMITH_API_KEY with each run.

Step 6: Configure the dependabot.yml File

In your GitHub repository, create or update .github/dependabot.yml. The example below uses a Maven repository configuration, but this works with other package ecosystems, including npm, pip, and more (see the Dependabot configuration guide for details).:

Replace YOUR-ORG and YOUR-REPO with your actual Cloudsmith organization and repository details. This configuration will enable Dependabot to connect to Cloudsmith for dependency updates.

Step 7: Set Up a GitHub Action Workflow to Overwrite the Dependabot API Key with an Ephemeral OIDC Token

This workflow will authenticate with Cloudsmith via OIDC, generate a short-lived token, and overwrite the DEP_CLOUDSMITH_API_KEY used by Dependabot. Given that Cloudsmith’s OIDC tokens expire every 2 hours, this example schedules token rotation every 11 hours to align with Dependabot’s run schedule. If your setup requires more frequent rotations or encounters token expiration issues, adjust the schedule accordingly.

In your repository, create a file at .github/workflows/update-cloudsmith-key.yml.

Replace YOUR-ORG with your Cloudsmith organization slug.

Replace YOUR-SERVICE-SLUG with the slug of the Cloudsmith service account created earlier.

This workflow uses OIDC to obtain a JWT from Cloudsmith, overwriting the DEP_CLOUDSMITH_API_KEY Dependabot secret with an ephemeral, short-lived token.

 in your GitHub repository and manually run the workflow.

Ensure Dependabot is fetching updates from Cloudsmith and creating pull requests as expected.

This setup allows Dependabot to use a short-lived Cloudsmith OIDC token, enhancing security by overwriting the DEP_CLOUDSMITH_API_KEY secret with each token request.

Next: Learn how to leverage Cloudsmith with Dependabot to streamline your dependency management 

Integrating Dependabot with Cloudsmith Using OIDC

 is a modern CI/CD platform designed for Kubernetes and microservices applications. It provides developers with fast, powerful pipelines and deep integration with Kubernetes. The platform’s features, such as enhanced caching, parallelization, and flexible triggers, allow teams to optimize their continuous integration workflows.

 to offer a comprehensive GitOps platform for Kubernetes. GitOps helps teams automate their infrastructure and application management, using Git as the single source of truth for deployments. By leveraging Argo within Codefresh, developers can employ advanced deployment strategies such as canary releases and blue-green deployments, improving release quality and reducing risks.

Benefits of Using Codefresh and Cloudsmith Together

, a cloud-native artifact management platform, with 

 enhances your CI/CD workflows in several significant ways. This powerful combination automates artifact handling, simplifies deployments, and enables the adoption of GitOps practices for Kubernetes deployments.

By automating artifact publishing within Codefresh pipelines, developers can significantly reduce manual steps, minimizing errors and ensuring artifacts are securely available for deployment. Cloudsmith’s support for multiformat repositories ensures that microservices using different package formats—such as Docker, npm, Helm, and Maven—can be managed and retrieved consistently.

Integrating Cloudsmith with Codefresh streamlines deployment processes by allowing developers to pull artifacts directly into their Codefresh pipelines. Whether deploying Docker images or Helm charts, this integration ensures consistency across all environments, from development to production, reducing deployment discrepancies.

, developers can ensure that only approved and secure components are used in their pipelines. Features like quarantine and upstream proxying add further control over unapproved or vulnerable dependencies. This guarantees a secure, compliant software supply chain.

Adopting GitOps for Kubernetes Deployments

Combining Cloudsmith and Codefresh enables teams to fully adopt GitOps practices for Kubernetes deployments. GitOps ensures that deployments are automated and aligned with the desired state defined in Git repositories. With Argo built into Codefresh, continuous reconciliation of your Kubernetes clusters keeps your infrastructure consistent with what’s declared in your codebase.

By integrating these platforms, you automate artifact handling, simplify deployments, and enhance security—all while adopting GitOps practices for Kubernetes deployments. This empowers your team to focus on delivering value—writing code, innovating features, and improving products—while the integration handles the complexities of artifact management and deployment.

How to Set Up a Pipeline with Codefresh and Cloudsmith

Setting up a CI/CD pipeline that integrates Codefresh and Cloudsmith is straightforward. Below is a guide to configure your pipeline for seamless artifact management and deployment using either 

 and create repositories for your artifacts.

: Ensure you have access to a Kubernetes cluster connected to Codefresh for deployments.

Open your Codefresh pipeline and go to the 

Name the variable (e.g., CLOUDSMITH_API_KEY), input your API key, and toggle 

Reference the API key in your pipeline YAML using ${{CLOUDSMITH_API_KEY}}.

 in Cloudsmith (required for OIDC to work with Cloudsmith).

Claims: For example add your Codefresh account ID to restrict access. For more information on claims consult the 

Assign the service account you created earlier.

In Codefresh, set up OIDC authentication by configuring your pipeline to request OIDC tokens during execution.

Add steps in your pipeline YAML to obtain and use the OIDC token for authenticating with Cloudsmith.

Modify your pipeline YAML to include steps that push build artifacts to Cloudsmith after successful builds.

To publish Helm charts, you need to use the Cloudsmith CLI. Ensure that the CLI is installed in your pipeline environment. For more details, refer to the Cloudsmith Helm documentation.

Deploying Artifacts from Cloudsmith Using Codefresh

Codefresh offers several ways to deploy your Docker images and Helm charts to your Kubernetes cluster using artifacts stored in Cloudsmith:

Using the Codefresh GUI to Deploy on Demand

: Choose Docker images from your connected Cloudsmith Docker registry.

: Select Helm charts from your added Cloudsmith Helm repository.

: Use Docker images stored in Cloudsmith within your pipeline steps.

: Utilize the Helm step in your pipeline to deploy charts from your Cloudsmith Helm repository.

Kubernetes Templating (cf-deploy-kubernetes)

: Employ templated deployments for consistent configurations.

: Execute custom kubectl commands within your pipeline, referencing artifacts from Cloudsmith.

: Directly deploy Helm charts to your Kubernetes clusters.

: For advanced GitOps deployments, integrate 

 with Codefresh. This allows automated deployment of applications to Kubernetes clusters using Cloudsmith as your artifact source.

Example of Pulling a Docker Image Using OIDC

Below is an example pipeline demonstrating how to authenticate with Cloudsmith using OIDC and deploy a Docker image:

: Retrieves an OIDC token required for authentication.

: Uses the OIDC token to obtain a Cloudsmith-specific token.

: Logs into the Cloudsmith Docker registry using the obtained OIDC token and pulls the desired Docker image.

: Verifies the successful pull by checking the Docker image's history.

: Ensure that the Cloudsmith CLI is installed in your pipeline environment if you plan to publish Helm charts or perform other CLI-based operations. Refer to the Cloudsmith Helm documentation for more details.

: Prefer OIDC over API keys for enhanced security and simplified credential management.

 when deploying artifacts from Cloudsmith. This ensures that deployment pipelines only have the necessary access to pull artifacts without the risk of modifying or deleting them, thus improving the security of your deployment process.

: Store sensitive information like API keys or OIDC tokens securely using Codefresh's encrypted variables or secret management features.

: Leverage Codefresh pipelines and GitOps practices to automate deployment steps, reducing manual intervention and potential errors.

: Utilize Codefresh's dashboards and integrations to monitor deployment status and health, ensuring quick identification and resolution of issues.

: Maintain your deployment manifests in Git repositories for version control, traceability, and easier collaboration.

Integrating Cloudsmith with Codefresh optimizes your CI/CD pipelines by providing secure, automated artifact management and simplifying deployments. With Cloudsmith’s support for multiple package formats and Codefresh’s robust CI/CD capabilities tailored for Kubernetes and microservices, this integration is ideal for modern, distributed applications.

GitOps Pipelines with Codefresh and Cloudsmith

User management is the backbone of secure and efficient software operations. As businesses grow and evolve, the tools they use must keep pace. Enter OKTA and Cloudsmith. OKTA, a titan in identity and access management, combined with Cloudsmith, the powerhouse of software artifact management, offers a solution that's both robust and user-friendly. This guide looks at how these platforms can be integrated to elevate your user management game.

User management is about controlling access to a system or application. It's a delicate balance: ensuring security while facilitating collaboration. Effective user management optimizes resource use, prevents unauthorized access, and tailors user experiences based on roles and needs.

The road to effective user management is often dotted with hurdles. These can range from setting up appropriate permissions, managing inactive users, to staying compliant with industry regulations.

Since its inception in 2009, OKTA has carved a niche for itself in the identity and access management sector. Its cloud-based platform, equipped with tools for user authentication, caters to businesses of all sizes, ensuring secure and seamless user experiences.

Okta offers a suite of features such as Provisioning, Single Sign-On (SSO), integration with Active Directory (AD) and LDAP, centralized user deprovisioning, multifactor authentication (MFA), and mobile identity management. These are complemented by adaptable policies tailored for organizational security. These capabilities are seamlessly integrated through the Okta Integration Network (OIN), a collection of pre-integrated applications. The OIN ensures that users can enjoy SSO login across all essential apps they interact with daily.

OKTA's strengths lie in its single sign-on capabilities, multi-factor authentication, and comprehensive lifecycle management. For those looking to streamline user management, OKTA's intuitive interface and extensive API integrations make it an indispensable tool.

Cloudsmith stands out as a leading software artifact management platform. It offers teams a centralized hub to store, manage, and distribute software artifacts, ensuring that software components are consistently available and secure.

Users can upload data, software, and dependencies into Cloudsmith or pull it from third-party sources. We then control distribution to their developers, servers, or external customers. Our primary mission is to contain 100% of the software and related data for users within Cloudsmith, keeping everyone safe.

But of course, we understand that different users have different needs. While some may be uploading artifacts, others might be in roles that require only viewing or downloading capabilities. Effective user management in Cloudsmith ensures that each user has the right permissions, enhancing security and operational efficiency.

Pairing OKTA with Cloudsmith is like merging the best of both worlds. Cloudsmith's prowess in artifact management is complemented by OKTA's user management capabilities. This integration not only simplifies access but also amplifies security measures, ensuring that the right people access the right artifacts at the right time.

Setting up the OKTA integration is quite straightforward, and to help you through the process we have put together a 

 in our Help Center. The integration includes SCIM provisioning, making it easier to manage users in your organization with minimal impact to your workflows.

Cloudsmith’s OKTA integration not only allows for user management, but also group management. This allows your organization to define clear user roles and groups based on job responsibilities and access levels.

Automated Provisioning and Deprovisioning

One of the standout features of Cloudsmith's OKTA integration is the ability to automate user provisioning and deprovisioning. This automation is crucial for organizations that prioritize security and efficiency.

When a new team member joins, the onboarding process often involves granting access to multiple tools and platforms. With automated provisioning, as soon as a user is added to OKTA, they're automatically granted access to Cloudsmith, eliminating manual steps and potential oversights. Conversely, when an employee leaves or changes roles, their access can be automatically adjusted or revoked, ensuring that only current team members have access to your critical systems.

Cloudsmith's OKTA integration can be seamlessly connected with HR systems. This means that any changes in the HR system, such as a new hire or a departure, can trigger the appropriate provisioning or deprovisioning actions in Cloudsmith. This integration further streamlines the user lifecycle management, reducing administrative overhead and potential errors.

It is not uncommon for user data to be scattered across multiple systems, and we all know how difficult that can be to manage! This fragmentation can lead to inconsistencies, security vulnerabilities, and administrative headaches. Cloudsmith's OKTA integration addresses this challenge head-on by ensuring that OKTA serves as the single, central source of truth for user information.

When OKTA is the authoritative source, any changes made there—like updating an email address or changing a department—will automatically sync to Cloudsmith. This ensures that user data remains consistent across platforms. By centralizing user information, organizations can reduce the risk of data discrepancies, improve auditability, and simplify user management.

Learn more about getting started with creating and managing teams in in Cloudsmith in the short video below:

Teams and Access Controls

As organizations increasingly rely on platforms like Cloudsmith for their operations, ensuring the protection of user data and maintaining a secure user management system becomes paramount. Let's delve into the security considerations you should be aware of when managing users with Cloudsmith and OKTA.

User data is a valuable asset, and its protection is non-negotiable. Cloudsmith is committed to safeguarding this data, implementing stringent security measures that align with industry best practices. When integrated with OKTA, the data protection capabilities are further enhanced. OKTA employs robust encryption methods, both in transit and at rest, ensuring that user data remains confidential and tamper-proof. Regular security audits, penetration testing, and compliance certifications further attest to the platform's commitment to data protection.

Role of OKTA in Enhancing Cloudsmith's Security

OKTA doesn't just streamline user management—it amplifies security. By integrating with Cloudsmith, OKTA brings its advanced security features, such as multifactor authentication (MFA), to the table. MFA requires users to provide multiple forms of identification before gaining access, significantly reducing the risk of unauthorized access. Additionally, OKTA's adaptive authentication measures assess various risk factors, like location and device, adjusting authentication requirements based on the perceived risk level. This dynamic approach ensures that security doesn't come at the expense of user experience.

Tips for Maintaining a Secure User Management System

: Periodically audit user roles and permissions. Ensure that employees only have access to the resources necessary for their roles.

: Ensure that all systems are regularly updated. Security patches and updates address vulnerabilities and enhance overall system security.

: A secure system is only as strong as its weakest link. Regularly train your team on security best practices, emphasizing the importance of strong, unique passwords and recognizing phishing attempts.

 Set up monitoring to detect any unusual activities. Immediate alerts for suspicious actions can help in quickly identifying and mitigating potential security threats.

: While not strictly a security measure, regular backups ensure that you can quickly recover user data in the event of any unforeseen circumstances, be it a technical glitch or a cyberattack.

The integration of OKTA with Cloudsmith is a testament to the evolution of user management in the digital age. By combining the strengths of two industry leaders, organizations can ensure a seamless, secure, and efficient user management experience. As the digital landscape continues to evolve, so do the challenges associated with user management. However, with tools like OKTA and Cloudsmith, businesses are well-equipped to navigate these challenges, ensuring that their operations remain secure, streamlined, and scalable. Whether you're just starting out or looking to enhance your existing setup, the OKTA-Cloudsmith integration offers a robust solution that caters to the diverse needs of modern organizations.

Managing Users and User Groups: A Guide to OKTA and Cloudsmith Integration

The team at Cloudsmith is excited to build upon our past support and integration with Hashicorp Terraform to include managing teams, update repository settings, and manage services (API Keys) via the Terraform Provider Module. And we are an official Partner, check out the fancy handshake badge!

While Cloudsmith and Terraform are nothing new to each other, the capabilities continue to grow based on community and customer feedback.

For a few years now, Cloudsmith has included Terraform 

 capabilities to help manage both public and private modules or packages. Cloudsmith delivers on the promise of being truly universal and offering a variety of packaging formats in a consistent and secure way. Review the 

 has long been the industry standard for infrastructure and application provisioning via code.

Why not manage Cloudsmith with Terraform?

, users can quickly and easily provision Cloudsmith resources and realize the benefits of Infrastructure-As-Code for creating and managing repositories and access control.

Overview of the Cloudsmith Terraform Provider

 allows Cloudsmith users to automate the provisioning of resources using Terraform. New capabilities are highlighted below.

Users can:

Create and manage repositories, including 

Create and manage entitlement tokens, granting read-only access to end users

Create and manage services (API keys for machine-to-machine or programmatic access) for a Cloudsmith organization

Create and manage teams within a Cloudsmith organization

Create and manage webhooks for a given Cloudsmith repository

The trend to manage every aspect of the infrastructure lifecycle is expanding with each and every revision. Databases and database schemes are even being managed with Terraform and infrastructure as code. DevOps and Platform teams are attempting to realize the goal of a platform-as-a-service, and the Cloudsmith team wants to help everyone reach that potential.

provider "cloudsmith" {
api_key = "my-api-key"
}

data "cloudsmith_namespace" "my_namespace" {
slug = "my-namespace"
}

resource "cloudsmith_repository" "my_repository" {
description = "A certifiably-awesome private package repository"
name = "My Repository"
namespace = "${data.cloudsmith_namespace.my_namespace.slug_perm}"
slug = "my-repository"
}

resource "cloudsmith_entitlement" "my_entitlement" {
name = "Test Entitlement"
namespace = "${cloudsmith_repository.test.namespace}"
repository = "${cloudsmith_repository.test.slug_perm}"
}

Terraform plus Cloudsmith is a powerful combination. It allows you to automate the creation of your package repositories and associated access tokens in a controlled, reproducible way. Also, as you have now defined these resources as code, you can version them and treat them as you would any other source code that you have.

The Terraform Module Registry is the home for the validated Terraform provider; find out about the latest enhancements in the 

. If you like to test things out on your own, sign up for a 

 to realize the value and benefits of Terraform and Cloudsmith together!

Terraform Provider Enhancements

UnblockConf21 – Buildkite Webinar with Cloudsmith

Join Ciara Carey, DevRel at Cloudsmith, and Nick Rycar from Buildkite, as they explore what it means to combine Cloudsmith’s continuous packaging with Buildkite’s integration & delivery to truly have a continuous software pipeline in the cloud.

Cloudsmith is happy to announce an integration with Datadog to help our customers monitor their Cloudsmith account.

 is an observability service for cloud-scale apps, providing monitoring of servers, databases, tools, and services through a SaaS based data analytics platform. At Cloudsmith we are big fans of Datadog and use it to monitor and visualize how our system is performing across a range of services and tools.

The Datadog Cloudsmith Integration, allows users to monitor their storage, bandwidth, and token usage in Datadog. This 

 is crucial in monitoring your consumption and mitigating against getting an unexpected overage bill- the Datadog Cloudsmith integration is another way for you and your team to monitor this.

The following metrics will be tracked by the Datadog Cloudsmith integration:

- follow these steps to install and configure your Cloudsmith integration.

First things first you need to install the Datadog Agent.

The Datadog Agent is software that runs on your hosts. It collects events and metrics from hosts and sends them to Datadog, where you can analyze your monitoring and performance data. To install the datadog agent, follow the steps 

Cloudsmith Datadog Integration Installation

For Agent v7.21+ / v6.21+, follow the instructions below to install the Cloudsmith check on your host. Run the following command to install the Cloudsmith Agent integration:

datadog-agent integration install -t datadog-cloudsmith==<INTEGRATION_VERSION>

Configure your integration similar to core 

. The Cloudsmith integration has 3 configuration values:

This is the url to the Cloudsmith API and will not change (


Follow these steps to configure your Cloudsmith integration:

View your Cloudsmith Dashboard in Datadog

Datadog dashboards enable you to efficiently monitor your infrastructure and integrations by displaying and tracking key metrics. Once the Agent is installed with the Cloudsmith check, you can use the metrics in any datadog dashboard.

To make life easier for you, the Cloudsmith Datadog Integration comes with it’s own dashboard allowing you to monitor your Cloudsmith accounts storage, bandwidth, and token usage.

The Cloudsmith Dashboard can be viewed by following these instructions:

Select your installed Cloudsmith dashboard- it will be listed as 


The dashboard above tracks tokens and consumption usage in an Organization:

The Datadog Cloudsmith Integration is a simple and effective visualisation tool for monitoring your token, storage and bandwidth usage- never be surprised by an unexpected overage and give yourself time to change your settings before you reach your limit. If you identify a limit that is approaching a threshold, then you can quickly and easily 

If you already use Datadog to monitor your tools and services, this tool is for you!

Datadog Cloudsmith Integration

Using CircleCI to push packages to Cloudsmith

A short demo of how you can use a CircleCI pipeline and the Cloudsmith CircleCI Orb to push a package to a private Cloudsmith repository.

Using CircleCI to Push Packages to Cloudsmith

LF Live Webinar: Continuous...Everything? Integration, Packaging, Delivery, and Security All in One!

Application delivery pipelines share many traits with any assembly line.

Open source libraries, runtimes, databases, and base images are raw materials to be inspected to ensure they meet quality and security standards. Modern applications combine these raw materials with custom code to create dynamic and complex environments, opening up an extremely effective attack vector.

While not new, software supply chain attacks are on the rise with changes in how applications are built. With open source components making up more than 80% of modern codebases, having a reliable “source of truth” for the security, compliance, and provenance of software and its dependencies is critical.

In this webinar, Snyk, CircleCI and Cloudsmith will share practices and tools that are helping developers create applications with integrity, quality, and security.

Find and fix known vulnerabilities in app dependencies and container images

Build a source of truth for open source packages to avoid malicious packages

Combine continuous packaging and security into a CircleCI delivery pipeline Create provenance and security quality gates as part of deployment workflows

Join Ryan Pedersen (CircleCI), Tom Gibson (Cloudsmith), and Tomas Gonzalez (Snyk) to learn how to manage and mitigate this new risk profile and create a more holistic application security approach.

Continuous...Everything? Integration, Packaging, Delivery, and Security All in One!

At Cloudsmith, you will often hear us refer to our mantra of “Automate Everything”. It's a quest that we never deviate from, and we believe that anything that can be automated, should be automated.

With that in mind, we would like to show you how simple it is to integrate a Cloudsmith repository with your Buildkite pipeline, and automate the pushing of your build artifacts into your own private repository for further CI/CD steps or even as a source for your global distribution needs.

Buildkite is a platform for running fast, secure, and scalable continuous integration pipelines on your own infrastructure. That means you can use Buildkite to orchestrate and manage your own fleet of build hosts, and these can be anything from containers, to cloud instances, to bare metal servers.

Why would I want to integrate Cloudsmith with Buildkite?

Well, in short, a continuous integration pipeline is going to have an output, and you are going to need and want to put that output somewhere that is secure, controlled and integrates with all the other tooling that will form the next parts of your DevOps workflow - whether that is continuous deployment to production, distribution to an end user or customer, or even consumption by another internal team as part of their development process.

This is where Cloudsmith fits in, and this is another phrase you might hear us use quite a bit - Cloudsmith offers a central source of truth for your packages and build artifacts. We provide a global platform that gives you the performance, scalability, security and visibility that you need to control and manage your software assets.

Using Buildkite and Cloudsmith – An Example:

So, you’re let’s assume that you’re new to Buildkite, how do you get started?

The first thing that you need to do is install the buildkite-agent so that you have a machine (remember, this can be a container, a VM, or even a real server) that will act as your build host. Buildkite provides install instructions for all major platforms and operating systems:

Once you have installed the agent, you will see a new build host in the Buildkite UI:

For this example, I have installed the buildkite-agent on a Debian instance.

The next thing you need to do is create your pipeline. A Buildkite pipeline is a series of steps that your build host(s) will execute in order to build your assets/artifacts. For this example, we will create a pipeline that will compile a simple C source program, package it into a deb package and then push that deb package to a Cloudsmith repository.

To get started, you give your pipeline a name, and then you specify a source repository for the pipeline. In this case, it is a GitHub repository (although Buildkite will also work with many other platforms as a source):

If using a private GitHub repository, you also need to remember to add an SSH key to your GitHub profile so that the host you have installed the buildkite-agent on can access the source repository.

Pipeline steps are where you specify the commands or scripts that you need to run in order to build your source / project / application. In Buildkite, you can define these steps via the Buildkite UI or as a pipeline.yaml file. To keep things simple, we will define two steps via the Buildkite UI.

In this step, we install the tools we need to build our source and package it into a deb package. We also install the Cloudsmith CLI:

In this step, we use `make` to compile our source and then we use `fpm` to build the deb package. Finally, we use the `cloudsmith push` command to push the package to our Cloudsmith repository:

The equivalent pipeline.yaml file for these steps would look like:

Cloudsmith blog

Integrating Dependabot with Cloudsmith Using OIDC

GitOps Pipelines with Codefresh and Cloudsmith

Managing Users and User Groups: A Guide to OKTA and Cloudsmith Integration

Terraform Provider Enhancements

UnblockConf21 – Buildkite Webinar with Cloudsmith

Datadog Cloudsmith Integration

Using CircleCI to Push Packages to Cloudsmith

Continuous...Everything? Integration, Packaging, Delivery, and Security All in One!

Integrating a Cloudsmith Repository and a Buildkite pipeline

Integrating a Cloudsmith repository with a Semaphore CI workflow

Using Semaphore CI to Push packages to Cloudsmith

Integrating a Cloudsmith repository with a Harness CD pipeline