Skip to content
Docs SuperPlane Docs

Cloudsmith

Automate repository, package, and artifact management on Cloudsmith

Triggers

Section titled “Triggers”
On Package Created Trigger a workflow when a new package is created (uploaded) in a Cloudsmith repository
On Security Scan Completed Trigger a workflow when a Cloudsmith package's security (vulnerability) scan completes

Actions

Section titled “Actions”
Create Vulnerability Policy Create an organization-scoped package vulnerability policy in Cloudsmith
Delete Package Delete a package from a Cloudsmith repository
Delete Vulnerability Policy Delete an organization-scoped package vulnerability policy from Cloudsmith
Get Package Retrieve metadata for a specific Cloudsmith package
Get Package Vulnerabilities Retrieve the latest vulnerability scan result for a specific Cloudsmith package
Get Repository Fetch details of a Cloudsmith repository
Get Vulnerability Policy Retrieve an organization-scoped package vulnerability policy from Cloudsmith
List Packages List packages in a Cloudsmith repository with optional filtering by sync status, quarantine, and vulnerability
Promote Package Copy or move a package from one Cloudsmith repository to another
Quarantine Package Quarantine or release a Cloudsmith package
Resync Package Schedule a Cloudsmith package for resynchronization
Scan Package Schedule a vulnerability scan for a specific Cloudsmith package
Tag Package Add, replace, clear, or remove tags for a Cloudsmith package

Instructions

Section titled “Instructions”

Cloudsmith Service Account API Key

Section titled “Cloudsmith Service Account API Key”

SuperPlane authenticates to Cloudsmith using a service account API key, which is not tied to an individual user.

  1. In the Cloudsmith web dashboard, go to the Accounts tab and click on Services
  2. Click on New Service. Give the service a name like Superplane and optional description. Assign the Manager role to the service.
  3. Click on Create Service and copy the generated API key.
  4. Paste the API key below.
  5. To give the service access to any repository, click on your Repository and then Settings → Access control → Privileges for specific services, and add the service with the Admin privilege.

Note: The Promote Package action (copy or move a package between repositories) requires Admin privilege on both the source and destination repositories. Make sure the service account has been granted Admin access to every repository it needs to promote packages to or from.

Note: The vulnerability policy actions (create, get, delete) are organization-scoped. The service account must have permission to manage policies in the target organization.

On Package Created

Section titled “On Package Created”

Trigger key: cloudsmith.onPackageCreated

The On Package Created trigger starts a workflow whenever a new package is uploaded to the selected repository.

Use Cases

Section titled “Use Cases”
  • Ingestion pipelines: React to new artifacts as they land — promote, tag, or notify
  • Auditing: Record who uploaded which package and when
  • Fan-out: Kick off downstream checks (e.g. fetch repository details) for each new package

Configuration

Section titled “Configuration”
  • Repository: The repository to watch, in the form owner/repository (required)

Webhook Setup

Section titled “Webhook Setup”

This trigger provisions a Cloudsmith webhook automatically: on setup it registers SuperPlane’s webhook URL on the selected repository for the package.created event, and removes it when the trigger is deleted. The Cloudsmith service account needs the Admin privilege on the repository for this. Each delivery is signed (HMAC-SHA1) with a per-node secret and verified on receipt, so forged or unsigned requests are rejected.

Output

Section titled “Output”

Emits the new package’s details: namespace, repository, name, version, slug_perm, format, license, uploader, uploaded_at, and status.

Example Data

Section titled “Example Data”
{
  "data": {
    "event": "package.created",
    "format": "npm",
    "license": "MIT",
    "name": "sp-compliance-mit",
    "namespace": "weskk",
    "repository": "superplane-compliance",
    "slug_perm": "wxu9RDqPfCj0",
    "status": "Completed",
    "uploaded_at": "2026-06-17T14:50:00.843111Z",
    "uploader": "superplane-dnig",
    "version": "1.0.0"
  },
  "timestamp": "2026-06-17T14:50:00Z",
  "type": "cloudsmith.package.created"
}

On Security Scan Completed

Section titled “On Security Scan Completed”

Trigger key: cloudsmith.onSecurityScanCompleted

The On Security Scan Completed trigger starts a workflow whenever Cloudsmith finishes scanning a package in the selected repository for vulnerabilities.

Use Cases

Section titled “Use Cases”
  • Block vulnerable packages: Quarantine or reject a package when its scan finds High/Critical vulnerabilities
  • Security alerts: Notify a channel when vulnerabilities are detected
  • Audit: Record the scan outcome for every package

Configuration

Section titled “Configuration”
  • Repository: The repository to watch, in the form owner/repository (required)

Webhook Setup

Section titled “Webhook Setup”

This trigger provisions a Cloudsmith webhook automatically: on setup it registers SuperPlane’s webhook URL on the selected repository for the package.security_scanned event, and removes it when the trigger is deleted. The Cloudsmith service account needs the Admin privilege on the repository for this. Each delivery is signed (HMAC-SHA1) with a per-node secret and verified on receipt, so forged or unsigned requests are rejected.

Output

Section titled “Output”

Emits the package’s identity (namespace, repository, name, version, slug_perm, format) and the scan results: security_scan_status, has_vulnerabilities, max_severity, num_vulnerabilities, and vulnerability_scan_results_url. Because this fires when the scan completes, the vulnerability fields are settled — filter downstream, e.g. only act when max_severity is High/Critical.

Example Data

Section titled “Example Data”
{
  "data": {
    "event": "package.security_scanned",
    "format": "npm",
    "has_vulnerabilities": true,
    "max_severity": "High",
    "name": "sp-compliance-gpl",
    "namespace": "weskk",
    "num_vulnerabilities": 2,
    "repository": "superplane-compliance",
    "security_scan_status": "2 Vulnerabilities Detected",
    "slug_perm": "f3XvJCI9ufJa",
    "version": "1.0.0",
    "vulnerability_scan_results_url": "https://api.cloudsmith.io/v1/vulnerabilities/weskk/superplane-compliance/f3XvJCI9ufJa/"
  },
  "timestamp": "2026-06-18T14:17:58Z",
  "type": "cloudsmith.package.securityScanned"
}

Create Vulnerability Policy

Section titled “Create Vulnerability Policy”

Component key: cloudsmith.createVulnerabilityPolicy

The Create Vulnerability Policy component creates a package vulnerability policy for a Cloudsmith organization. A vulnerability policy quarantines packages whose security scan detects vulnerabilities at or above a minimum severity.

Use Cases

Section titled “Use Cases”
  • Automated guardrails: Provision a policy as part of bootstrapping a new organization or repository set
  • Policy-as-code: Manage vulnerability policies from a workflow instead of the Cloudsmith UI
  • Severity gating: Quarantine packages that introduce High or Critical vulnerabilities

Configuration

Section titled “Configuration”
  • Organization (required): The organization the policy belongs to.
  • Name (required): A descriptive name for the policy (max 100 characters).
  • Description: An optional description (max 250 characters).
  • Minimum Severity: The lowest severity that triggers the policy (Low, Medium, High, Critical). Defaults to Critical.
  • Package Query: An optional Cloudsmith search query restricting which packages the policy applies to.
  • Quarantine on Violation: Whether matching packages are quarantined when the policy is violated.
  • Allow Unknown Severity: Whether vulnerabilities with an unknown severity are permitted.

Output

Section titled “Output”

Returns the created policy including:

  • name / description: Policy name and description
  • min_severity: Minimum severity that triggers the policy
  • package_query_string: The package query the policy applies to
  • on_violation_quarantine: Whether matching packages are quarantined
  • allow_unknown_severity: Whether unknown-severity vulnerabilities are allowed
  • slug_perm: Permanent identifier of the policy
  • created_at / updated_at: Policy timestamps

Example Output

Section titled “Example Output”
{
  "data": {
    "allow_unknown_severity": false,
    "created_at": "2026-01-15T10:00:00.000Z",
    "description": "Quarantine packages with critical vulnerabilities",
    "min_severity": "Critical",
    "name": "Block critical vulnerabilities",
    "on_violation_quarantine": true,
    "package_query_string": "format:docker",
    "slug_perm": "abc123def456",
    "updated_at": "2026-01-15T10:00:00.000Z"
  },
  "timestamp": "2026-01-15T10:00:00.000Z",
  "type": "cloudsmith.vulnerabilityPolicy.created"
}

Delete Package

Section titled “Delete Package”

Component key: cloudsmith.deletePackage

The Delete Package component deletes a package from a Cloudsmith repository.

Configuration

Section titled “Configuration”
  • Repository: The repository that contains the package.
  • Package Identifier: The Cloudsmith package identifier (slug_perm).

Output

Section titled “Output”

Emits the deleted package identifier on the default channel.

Example Output

Section titled “Example Output”
{
  "data": {
    "package": "example-package-id",
    "repository": "example-owner/example-repo"
  },
  "timestamp": "2026-01-01T00:00:00Z",
  "type": "cloudsmith.package.deleted"
}

Delete Vulnerability Policy

Section titled “Delete Vulnerability Policy”

Component key: cloudsmith.deleteVulnerabilityPolicy

The Delete Vulnerability Policy component removes a package vulnerability policy from a Cloudsmith organization. Cloudsmith does not support deactivating a policy, so deleting it is the way to stop it from being enforced.

Use Cases

Section titled “Use Cases”
  • Decommissioning: Remove a policy that is no longer needed
  • Policy rotation: Delete an old policy before creating a replacement
  • Cleanup: Tear down policies created for short-lived environments

Configuration

Section titled “Configuration”
  • Organization (required): The organization the policy belongs to.
  • Policy (required): The policy to delete (its permanent slug). Supports expressions.

Output

Section titled “Output”

Returns confirmation of the deletion including:

  • organization: The organization the policy belonged to
  • slug_perm: Permanent identifier of the deleted policy
  • deleted: Always true on success

Example Output

Section titled “Example Output”
{
  "data": {
    "deleted": true,
    "organization": "acme",
    "slug_perm": "abc123def456"
  },
  "timestamp": "2026-01-15T10:00:00.000Z",
  "type": "cloudsmith.vulnerabilityPolicy.deleted"
}

Get Package

Section titled “Get Package”

Component key: cloudsmith.getPackage

The Get Package component retrieves complete metadata for a specific Cloudsmith package, including sync status, quarantine state, and security scan results.

Use Cases

Section titled “Use Cases”
  • Release gating: Check that a package is Available and sync-completed before triggering downstream deployment steps
  • Quarantine detection: Detect when a package has been quarantined or has policy violations
  • Audit trails: Record full package metadata (checksums, format, upload time) for compliance
  • Downstream enrichment: Pass package details such as format or CDN URL to later workflow steps
  • Checksum verification: Retrieve SHA-256 or MD5 checksums to validate package integrity
  • Security insights: Check the security scan status and link to full vulnerability results

Configuration

Section titled “Configuration”
  • Repository (required): The repository containing the package, in the form owner/repository.
  • Package (required): The unique package identifier (slug_perm). Supports expressions — use {{ $['On Package Uploaded'].package.slug_perm }} to reference an upstream trigger.

Output

Section titled “Output”

Returns the complete package object including:

  • name / version: Package name and version string
  • format: Package format (e.g., python, debian, docker, maven)
  • status / status_str: Overall status code and label (e.g. Available, Quarantined, Failed)
  • stage / stage_str: Processing stage (e.g. Fully Synchronised)
  • sync_progress: Sync completion percentage (0–100)
  • is_sync_completed / is_sync_failed: Final sync outcome flags
  • is_quarantined: Whether the package has been quarantined
  • security_scan_status: Result of the most recent security scan
  • vulnerability_scan_results_url: URL to full vulnerability scan results
  • checksum_md5 / checksum_sha1 / checksum_sha256 / checksum_sha512: Package checksums
  • size / size_str: Package size in bytes and human-readable form
  • cdn_url / self_html_url: Download and web UI URLs
  • uploaded_at: ISO 8601 upload timestamp

Example Output

Section titled “Example Output”
{
  "data": {
    "cdn_url": "https://dl.cloudsmith.io/basic/example-owner/example-repo/docker/example-package-id.manifest.json",
    "checksum_md5": "00000000000000000000000000000000",
    "checksum_sha1": "0000000000000000000000000000000000000000",
    "checksum_sha256": "0000000000000000000000000000000000000000000000000000000000000000",
    "checksum_sha512": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "description": "Example package payload",
    "display_name": "example-app",
    "filename": "example-app",
    "format": "docker",
    "is_quarantined": true,
    "is_sync_awaiting": false,
    "is_sync_completed": true,
    "is_sync_failed": false,
    "is_sync_in_flight": false,
    "is_sync_in_progress": false,
    "name": "example-app",
    "namespace": "example-owner",
    "policy_violated": false,
    "repository": "example-repo",
    "security_scan_completed_at": "2026-01-01T02:00:00Z",
    "security_scan_started_at": "2026-01-01T01:59:00Z",
    "security_scan_status": "Scan Detected Vulnerabilities",
    "self_html_url": "https://cloudsmith.io/~example-owner/repos/example-repo/packages/detail/docker/example-app/example-version/a=amd64;xpo=linux/",
    "self_url": "https://api.cloudsmith.io/v1/packages/example-owner/example-repo/example-package-id/",
    "self_webapp_url": "https://app.cloudsmith.com/example-owner/r/example-repo/docker/example-app/example-version/example-package-id",
    "size": 123456,
    "size_str": "",
    "slug": "example-app-abc1",
    "slug_perm": "example-package-id",
    "stage": 9,
    "stage_str": "Fully Synchronised",
    "stage_updated_at": "2026-01-01T01:58:00Z",
    "status": 7,
    "status_reason": "",
    "status_str": "Quarantined",
    "status_updated_at": "2026-01-01T02:05:00Z",
    "summary": "",
    "sync_finished_at": "2026-01-01T02:03:00Z",
    "sync_progress": 100,
    "tags": {
      "version": [
        "latest"
      ]
    },
    "tags_immutable": {},
    "uploaded_at": "2026-01-01T01:55:00Z",
    "uploader": "example-user",
    "version": "example-version",
    "vulnerability_scan_results_url": "https://api.cloudsmith.io/v1/vulnerabilities/example-owner/example-repo/example-package-id/"
  },
  "timestamp": "2026-01-01T02:06:00Z",
  "type": "cloudsmith.package.fetched"
}

Get Package Vulnerabilities

Section titled “Get Package Vulnerabilities”

Component key: cloudsmith.getPackageVulnerabilities

The Get Package Vulnerabilities component retrieves the most recent vulnerability scan result for a specific Cloudsmith package.

Use Cases

Section titled “Use Cases”
  • Release gating: Block promotion of packages that have known vulnerabilities
  • Audit reporting: Record vulnerability counts and max severity for compliance dashboards
  • Automated response: Route critical findings to an on-call team or trigger quarantine
  • Scan verification: Confirm a scan has completed and check its outcome after Scan Package

Configuration

Section titled “Configuration”
  • Repository (required): The repository containing the package, in the form owner/repository.
  • Package (required): The unique package identifier (slug_perm). Supports expressions — use {{ $['On Vulnerability Scan Completed'].data.slug_perm }} to reference an upstream trigger.

Output

Section titled “Output”

Returns the most recent scan result for the package:

  • identifier: Unique ID for this scan result entry
  • created_at: When the scan was completed (ISO 8601)
  • has_vulnerabilities: Whether any vulnerabilities were detected
  • num_vulnerabilities: Total number of vulnerabilities found
  • max_severity: Highest severity level detected (e.g. Critical, High, Medium, Low)
  • scan_id: Internal scan identifier (may be null)
  • package: Nested object with the scanned package details:
    • identifier: Package slug_perm
    • name: Package name
    • version: Package version or digest
    • url: Direct API URL for the package

Example Output

Section titled “Example Output”
{
  "data": {
    "created_at": "2026-01-01T02:00:00Z",
    "has_vulnerabilities": true,
    "identifier": "example-scan-identifier",
    "max_severity": "High",
    "num_vulnerabilities": 1,
    "package": {
      "identifier": "EXAMPLE123",
      "name": "example-app",
      "url": "https://api.cloudsmith.io/v1/packages/example-owner/example-repo/EXAMPLE123/",
      "version": "example-version"
    },
    "scan_id": null
  },
  "timestamp": "2026-01-01T02:05:00Z",
  "type": "cloudsmith.package.vulnerabilities"
}

Get Repository

Section titled “Get Repository”

Component key: cloudsmith.getRepository

The Get Repository component retrieves detailed information about a specific Cloudsmith repository.

Use Cases

Section titled “Use Cases”
  • Status checks: Verify a repository exists and is reachable before publishing or promoting packages
  • Information retrieval: Read repository visibility, namespace, and configuration
  • Storage monitoring: Track storage usage, package counts, and download metrics
  • Compliance checks: Inspect quarantined or policy-violating package counts before downstream actions

Configuration

Section titled “Configuration”
  • Repository: The repository to retrieve (required, supports expressions). The value is the repository identifier in the form owner/repository.

Output

Section titled “Output”

Returns the repository object including:

  • name: A descriptive name for the repository
  • slug: The slug that identifies the repository in URIs
  • namespace: The namespace (owner) the repository belongs to
  • repository_type_str: The visibility of the repository (Public, Private, Open-Source)
  • storage_region: The Cloudsmith region in which package files are stored
  • size / size_str: The calculated storage size of the repository
  • package_count: The number of packages in the repository
  • num_downloads: The number of downloads for packages in the repository
  • num_quarantined_packages: The number of quarantined packages
  • num_policy_violated_packages: The number of packages with policy violations

Example Output

Section titled “Example Output”
{
  "data": {
    "cdn_url": "https://dl.cloudsmith.io/public/acme/production",
    "content_kind": "Standard",
    "created_at": "2026-01-15T09:42:11.123456Z",
    "description": "Production packages for the ACME platform",
    "is_open_source": false,
    "is_private": true,
    "is_public": false,
    "name": "Production",
    "namespace": "acme",
    "namespace_url": "https://api.cloudsmith.io/v1/namespaces/acme/",
    "num_downloads": 18234,
    "num_policy_violated_packages": 2,
    "num_quarantined_packages": 1,
    "package_count": 312,
    "package_group_count": 47,
    "repository_type_str": "Private",
    "self_html_url": "https://cloudsmith.io/~acme/repos/production/",
    "self_url": "https://api.cloudsmith.io/v1/repos/acme/production/",
    "self_webapp_url": "https://cloudsmith.io/~acme/repos/production/",
    "size": 524288000,
    "size_str": "500.0 MB",
    "slug": "production",
    "slug_perm": "abcdef123456",
    "storage_region": "us-ohio"
  },
  "timestamp": "2026-03-12T21:13:32.946693411Z",
  "type": "cloudsmith.repository.fetched"
}

Get Vulnerability Policy

Section titled “Get Vulnerability Policy”

Component key: cloudsmith.getVulnerabilityPolicy

The Get Vulnerability Policy component retrieves a single package vulnerability policy for a Cloudsmith organization.

Use Cases

Section titled “Use Cases”
  • Drift detection: Read a policy’s current settings to confirm they match the intended configuration
  • Auditing: Record policy settings for compliance reporting
  • Conditional workflows: Branch downstream steps on a policy’s minimum severity or quarantine behaviour

Configuration

Section titled “Configuration”
  • Organization (required): The organization the policy belongs to.
  • Policy (required): The policy to retrieve (its permanent slug). Supports expressions.

Output

Section titled “Output”

Returns the policy including:

  • name / description: Policy name and description
  • min_severity: Minimum severity that triggers the policy
  • package_query_string: The package query the policy applies to
  • on_violation_quarantine: Whether matching packages are quarantined
  • allow_unknown_severity: Whether unknown-severity vulnerabilities are allowed
  • slug_perm: Permanent identifier of the policy
  • created_at / updated_at: Policy timestamps

Example Output

Section titled “Example Output”
{
  "data": {
    "allow_unknown_severity": false,
    "created_at": "2026-01-15T10:00:00.000Z",
    "description": "Quarantine packages with critical vulnerabilities",
    "min_severity": "Critical",
    "name": "Block critical vulnerabilities",
    "on_violation_quarantine": true,
    "package_query_string": "format:docker",
    "slug_perm": "abc123def456",
    "updated_at": "2026-01-20T14:30:00.000Z"
  },
  "timestamp": "2026-01-15T10:00:00.000Z",
  "type": "cloudsmith.vulnerabilityPolicy.fetched"
}

List Packages

Section titled “List Packages”

Component key: cloudsmith.listPackages

The List Packages component fetches all packages in a Cloudsmith repository and optionally filters them by sync status, quarantine state, or vulnerability scan result.

Use Cases

Section titled “Use Cases”
  • Release auditing: List all fully synchronized packages before a release gate
  • Quarantine monitoring: Enumerate quarantined packages for a security review workflow
  • Vulnerability triage: Retrieve packages with detected vulnerabilities and route them to a remediation step
  • Inventory: Collect a complete snapshot of packages in a repository for reporting

Configuration

Section titled “Configuration”
  • Repository (required): The repository to list packages from, in the form owner/repository.
  • Sync Status (optional): Filter by package synchronization state (Any, Fully Synchronised, Awaiting Sync, Sync Failed).
  • Quarantine Status (optional): Filter by quarantine state (Any, Quarantined, Not Quarantined).
  • Vulnerability Status (optional): Filter by security scan result (Any, No Vulnerabilities, Vulnerabilities Found).

Output

Section titled “Output”

Emits a single payload containing a packages array. Each entry includes:

  • display_name / format: Package display name and format
  • status_str / stage_str: Human-readable status and sync stage
  • is_quarantined / policy_violated: Quarantine and policy state
  • description / license: Package description and license
  • slug_perm / repository: Permanent identifier and repository slug
  • tags: Package tags

Example Output

Section titled “Example Output”
{
  "data": {
    "packages": [
      {
        "description": "Example application container image",
        "display_name": "example-app",
        "format": "docker",
        "is_quarantined": false,
        "license": "MIT",
        "policy_violated": false,
        "repository": "example-repo",
        "security_scan_status": "No Vulnerabilities Found",
        "slug_perm": "example-pkg-id-1",
        "stage_str": "Fully Synchronised",
        "status_str": "Available",
        "tags": {}
      },
      {
        "description": "Example application container image (previous release)",
        "display_name": "example-app",
        "format": "docker",
        "is_quarantined": true,
        "license": "MIT",
        "policy_violated": true,
        "repository": "example-repo",
        "security_scan_status": "Scan Detected Vulnerabilities",
        "slug_perm": "example-pkg-id-2",
        "stage_str": "Fully Synchronised",
        "status_str": "Available",
        "tags": {}
      }
    ]
  },
  "timestamp": "2026-01-15T14:35:00Z",
  "type": "cloudsmith.packages.listed"
}

Promote Package

Section titled “Promote Package”

Component key: cloudsmith.promotePackage

The Promote Package component copies or moves a package from a source repository to a destination repository within the same Cloudsmith namespace.

Use Cases

Section titled “Use Cases”
  • Promotion pipelines: Move a package from staging to production after all checks pass
  • Multi-environment distribution: Copy a package to multiple target repositories simultaneously
  • Artifact archiving: Move packages from active repositories to archive repositories
  • Release management: Promote a vetted version from a dev channel to a release channel

Configuration

Section titled “Configuration”
  • Source Repository (required): The repository that currently holds the package, in the form owner/repository.
  • Package (required): The unique package identifier (slug_perm). Supports expressions — use {{ $['On Package Created'].data.slug_perm }} to reference an upstream trigger.
  • Destination Repository (required): The target repository to promote the package into, in the form owner/repository.
  • Mode (required): Whether to copy (keep the original) or move (remove from source).

Output

Section titled “Output”

Returns the promoted package as it appears in the destination repository, including:

  • name / version: Package name and version
  • format: Package format (e.g., docker, python, debian)
  • repository / namespace: Where the package now lives
  • self_webapp_url: URL to the promoted package in the Cloudsmith web app
  • slug_perm: Permanent identifier of the package in the destination
  • uploaded_at: Original upload timestamp

Example Output

Section titled “Example Output”
{
  "data": {
    "cdn_url": "https://dl.cloudsmith.io/basic/example-owner/example-prod-repo/docker/example-app.manifest.json",
    "checksum_md5": "00000000000000000000000000000000",
    "checksum_sha1": "0000000000000000000000000000000000000000",
    "checksum_sha256": "0000000000000000000000000000000000000000000000000000000000000000",
    "checksum_sha512": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "display_name": "example-app",
    "format": "docker",
    "is_quarantined": false,
    "is_sync_awaiting": false,
    "is_sync_completed": true,
    "is_sync_failed": false,
    "is_sync_in_flight": false,
    "is_sync_in_progress": false,
    "name": "example-app",
    "namespace": "example-owner",
    "policy_violated": false,
    "repository": "example-prod-repo",
    "security_scan_status": "No Vulnerabilities Found",
    "self_html_url": "https://cloudsmith.io/~example-owner/repos/example-prod-repo/packages/detail/docker/example-app/1.2.0/",
    "self_url": "https://api.cloudsmith.io/v1/packages/example-owner/example-prod-repo/example-pkg-prod-id/",
    "self_webapp_url": "https://app.cloudsmith.com/example-owner/r/example-prod-repo/docker/example-app/1.2.0/example-pkg-prod-id",
    "size": 54525952,
    "size_str": "52.0 MB",
    "slug": "example-app-xyz9",
    "slug_perm": "example-pkg-prod-id",
    "stage": 9,
    "stage_str": "Fully Synchronised",
    "status": 2,
    "status_str": "Available",
    "sync_progress": 100,
    "tags": {},
    "tags_immutable": {},
    "uploaded_at": "2026-01-15T14:30:00Z",
    "uploader": "example-user",
    "version": "1.2.0"
  },
  "timestamp": "2026-01-15T15:00:00Z",
  "type": "cloudsmith.package.promoted"
}

Quarantine Package

Section titled “Quarantine Package”

Component key: cloudsmith.quarantinePackage

The Quarantine Package component quarantines or releases a Cloudsmith package.

Actions

Section titled “Actions”
  • Quarantine: Makes the package unavailable for download while keeping it in the repository. Useful when a package has known vulnerabilities or should not be consumed.
  • Release: Removes the quarantine on a previously quarantined package, making it available for download again once any remediation steps are complete.

Use Cases

Section titled “Use Cases”
  • Vulnerability response: Automatically quarantine packages when critical vulnerabilities are detected
  • Policy enforcement: Quarantine packages that violate license or security policies
  • Incident response: Immediately isolate a compromised package version
  • Remediation workflow: Release a package after confirming vulnerabilities have been addressed

Configuration

Section titled “Configuration”
  • Repository (required): The repository containing the package, in the form owner/repository.
  • Package (required): The unique package identifier (slug_perm). Supports expressions — use {{ $['On Vulnerability Scan Completed'].data.slug_perm }} to reference an upstream trigger.
  • Action (required): Whether to quarantine or release the package.

Output

Section titled “Output”

Returns the updated Cloudsmith package object reflecting the new quarantine state, including:

  • name / version: Package identifiers
  • status / status_str: Updated status — Quarantined after quarantine, or the previous status (e.g. Available) after release
  • format: Package format
  • cdn_url / self_html_url: Download and web UI URLs

Example Output

Section titled “Example Output”
{
  "data": {
    "cdn_url": "https://dl.cloudsmith.io/basic/example-owner/example-repo/docker/manifest.json",
    "checksum_md5": "00000000000000000000000000000000",
    "checksum_sha1": "0000000000000000000000000000000000000000",
    "checksum_sha256": "0000000000000000000000000000000000000000000000000000000000000000",
    "checksum_sha512": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "description": "Example quarantined package record",
    "format": "docker",
    "name": "example-app",
    "namespace": "example-owner",
    "repository": "example-repo",
    "self_html_url": "https://cloudsmith.io/~example-owner/repos/example-repo/packages/detail/docker/example-app/example-version/",
    "self_url": "https://api.cloudsmith.io/v1/packages/example-owner/example-repo/EXAMPLE123/",
    "size": 123456,
    "size_str": "",
    "slug": "example-app-er5g",
    "slug_perm": "EXAMPLE123",
    "status": 7,
    "status_str": "Quarantined",
    "summary": "",
    "uploaded_at": "2026-01-01T01:00:00Z",
    "version": "example-version-hash"
  },
  "timestamp": "2026-01-01T01:05:00Z",
  "type": "cloudsmith.package.quarantined"
}

Resync Package

Section titled “Resync Package”

Component key: cloudsmith.resyncPackage

The Resync Package component schedules a Cloudsmith package for resynchronization.

Configuration

Section titled “Configuration”
  • Repository: The repository that contains the package.
  • Package Identifier: The Cloudsmith package identifier (slug_perm).

Output

Section titled “Output”

Emits the package returned by Cloudsmith on the default channel.

Example Output

Section titled “Example Output”
{
  "data": {
    "cdn_url": "https://dl.cloudsmith.io/basic/example-owner/example-repo/docker/example-package-id.manifest.json",
    "checksum_md5": "00000000000000000000000000000000",
    "checksum_sha1": "0000000000000000000000000000000000000000",
    "checksum_sha256": "0000000000000000000000000000000000000000000000000000000000000000",
    "checksum_sha512": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "description": "Example resynced package payload",
    "display_name": "example-app",
    "filename": "example-app",
    "format": "docker",
    "is_quarantined": false,
    "is_sync_completed": false,
    "name": "example-app",
    "namespace": "example-owner",
    "repository": "example-repo",
    "self_html_url": "https://cloudsmith.io/~example-owner/repos/example-repo/packages/detail/docker/example-app/example-version/a=amd64;xpo=linux;id=example-package-id/",
    "self_url": "https://api.cloudsmith.io/v1/packages/example-owner/example-repo/example-package-id/",
    "self_webapp_url": "https://app.cloudsmith.com/example-owner/r/example-repo/docker/example-app/example-version/example-package-id",
    "size": 123456,
    "size_str": "",
    "slug": "example-app-abc1",
    "slug_perm": "example-package-id",
    "status": 2,
    "status_str": "Queued",
    "summary": "",
    "tags": {
      "version": [
        "latest"
      ]
    },
    "tags_immutable": {},
    "uploaded_at": "2026-01-01T00:00:00Z",
    "version": "example-version"
  },
  "timestamp": "2026-01-01T00:05:00Z",
  "type": "cloudsmith.package.resynced"
}

Scan Package

Section titled “Scan Package”

Component key: cloudsmith.scanPackage

The Scan Package component schedules a vulnerability scan for a specific Cloudsmith package.

Use Cases

Section titled “Use Cases”
  • On-demand scanning: Trigger a fresh scan after a package is uploaded or updated
  • Pre-promotion checks: Scan a package before promoting it to a production repository
  • Scheduled audits: Periodically re-scan packages to catch newly published CVEs

Configuration

Section titled “Configuration”
  • Repository (required): The repository containing the package, in the form owner/repository.
  • Package (required): The unique package identifier (slug_perm). Supports expressions.

Output

Section titled “Output”

Emits the repository and package identifiers confirming the scan was scheduled. Scan results are asynchronous — use the On Vulnerability Scan Completed trigger or the Get Package Vulnerabilities action to retrieve results once the scan finishes.

Example Output

Section titled “Example Output”
{
  "data": {
    "package": "example-package-id",
    "repository": "example-owner/example-repo"
  },
  "timestamp": "2026-01-01T00:00:00Z",
  "type": "cloudsmith.package.scan_scheduled"
}

Tag Package

Section titled “Tag Package”

Component key: cloudsmith.tagPackage

The Tag Package component updates tags for a Cloudsmith package.

Configuration

Section titled “Configuration”
  • Repository: The repository that contains the package.
  • Package Identifier: The Cloudsmith package identifier (slug_perm).
  • Action: Add, Clear, Replace, or Remove.
  • Tags: Tags to apply. Not required when the action is Clear.
  • Immutable: Marks newly created tags immutable when supported by Cloudsmith.

Output

Section titled “Output”

Emits the updated package returned by Cloudsmith on the default channel.

Example Output

Section titled “Example Output”
{
  "data": {
    "cdn_url": "https://dl.cloudsmith.io/basic/example-owner/example-repo/docker/example-package-id.manifest.json",
    "checksum_md5": "00000000000000000000000000000000",
    "checksum_sha1": "0000000000000000000000000000000000000000",
    "checksum_sha256": "0000000000000000000000000000000000000000000000000000000000000000",
    "checksum_sha512": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "description": "Example tagged package payload",
    "display_name": "example-app",
    "filename": "example-app",
    "format": "docker",
    "is_quarantined": false,
    "is_sync_completed": true,
    "name": "example-app",
    "namespace": "example-owner",
    "repository": "example-repo",
    "self_html_url": "https://cloudsmith.io/~example-owner/repos/example-repo/packages/detail/docker/example-app/example-version/",
    "self_url": "https://api.cloudsmith.io/v1/packages/example-owner/example-repo/example-package-id/",
    "self_webapp_url": "https://app.cloudsmith.com/example-owner/r/example-repo/docker/example-app/example-version/example-package-id",
    "size": 123456,
    "size_str": "",
    "slug": "example-app-abc1",
    "slug_perm": "example-package-id",
    "status": 4,
    "status_str": "Completed",
    "summary": "",
    "tags": {
      "info": [
        "example"
      ],
      "version": [
        "latest"
      ]
    },
    "tags_immutable": {},
    "uploaded_at": "2026-01-01T00:00:00Z",
    "version": "example-version"
  },
  "timestamp": "2026-06-19T10:21:49.411256712Z",
  "type": "cloudsmith.package.tagged"
}