chore(ENG-13952): add dev-release workflow for standalone binaries

[cloudsmith-iduffy]

What

Add a manually dispatched Dev Release workflow (ENG-13952). It builds the standalone binaries for the selected branch with the reusable binaries.yml workflow. It publishes them to the Cloudsmith repository set in the CLOUDSMITH_DEV_REPO repository variable.

How it works

• Only users with write access can dispatch the workflow.
• Packages keep the name cloudsmith-cli-<target>. Each build gets the version <base>-dev.<run_number>.g<short_sha> and the tags dev-build and branch-<name>.
• The dev version applies to the Cloudsmith package only. The binary itself reports the base version from cloudsmith_cli/data/VERSION. A build-time version override would change the reusable binaries.yml workflow and break its version smoketests, so it is out of scope here.
• The publish loop reads the target list from .github/scripts/binaries-matrix.json, the same source as the build matrix.
• The workflow verifies the SHA256 checksum of each archive before the upload.
• Authentication uses the same OIDC service account as the release workflow.
• The job summary lists the download URL and the SHA256 for each target.

Setup before the first run

• Create the dev repository in Cloudsmith: public, republish enabled, ~30-day retention.
• Set the CLOUDSMITH_DEV_REPO repository variable (done).
• Confirm the OIDC policy accepts ref: refs/heads/<branch> claims from this workflow.

Example run of this workflow can be seen at https://github.com/cloudsmith-io/cloudsmith-cli/actions/runs/31969009330?pr=357

[Copilot]

Pull request overview

Adds a manually-dispatched GitHub Actions workflow to publish “dev” builds of the standalone CLI binaries to a dedicated Cloudsmith repository, reusing the existing binaries.yml build workflow and OIDC auth approach.

Changes:

• Introduces a Dev Release workflow_dispatch workflow that builds standalone binaries via the reusable binaries.yml.
• Publishes artifacts to the Cloudsmith dev repo using a derived -dev.<run_number>.g<short_sha> Cloudsmith package version and dev-build/branch-<name> tags.
• Writes a job summary containing per-target download URLs and SHA256 values.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[BartoszBlizniak]

Nice one!

As part of this (or future ticket) we should add the ability to also consume the dev package via the install script

[BartoszBlizniak]

One nit: we should look into creating a new service account with write permissions to the new dev repo and adding it to the OIDC config (or creating a second OIDC config for the dev release).

[cloudsmith-iduffy]

Will create a follow up ticket for us to do that adjustment.

[cloudsmith-iduffy]

Will future ticket it. Retention rules on the repo are 30 days so the dev artifacts won't be staying around for too long.