feat: add Cloudsmith listPackages and promotePackages components

[felixgateru]

What changed

Extended the Cloudsmith integration with two new action components: ListPackages and PromotePackage.

Why

ListPackages — to give pipelines visibility into the state of packages in a repository.
PromotePackage — to automate the copy or move of a package from one repository to another within the same namespace (e.g. staging → production).

How

Backend

Extended pkg/integrations/cloudsmith/ with:

• list_packages.go — cloudsmith.listPackages action
• promote_package.go — cloudsmith.promotePackage action
• client.go — added ListPackagesWithFilters (paginated, accepts Lucene query string), CopyPackage (POST /packages/{owner}/{repo}/{id}/copy/), and MovePackage (POST /packages/{owner}/{repo}/{id}/move/).
• Added backend tests: list_packages_test.go and promote_package_test.go covering Setup, Execute, query building, and

Frontend

Added web_src/src/pages/app/mappers/cloudsmith/:

• list_packages.ts — node mapper;
• promote_package.ts — node mapper;
• types.ts — added ListPackagesConfiguration, TrimmedPackageData, ListPackagesData, PromotePackageConfiguration, PromotePackageResult.
• index.ts — registered both mappers in componentMappers and their registries in eventStateRegistry.

[superplanehq-integration]

👋 Commands for maintainers:

• /sp start - Start an ephemeral machine (takes ~30s)
• /sp stop - Stop a running machine (auto-executed on pr close)

[superplane-gh-integration-9000]

PR Risk Review

Risk: 25/100 (low)
Review approved: Yes
Check passed: Yes

Summary

Well-structured addition of two new Cloudsmith integration components (listPackages and promotePackage) with comprehensive tests, documentation, and frontend mappers following existing patterns.

Concerns

• The ListPackagesWithFilters function fetches all pages without any upper bound, which could lead to excessive memory usage or long-running requests for repositories with many thousands of packages.
• Cross-namespace validation in PromotePackage.Execute is only enforced at execution time, not during Setup, so misconfiguration won't be caught until the action runs.
• The promote_package_test.go Setup test for 'missing mode' doesn't provide a Metadata context, which may pass only because the error is hit before metadata resolution - could be fragile if validation order changes.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 76620e7. Configure here.}

[superplane-gh-integration-9000]

Risk: 35/100 (low)

Summary

Adds two new Cloudsmith integration components — ListPackages (with optional sync/quarantine/vulnerability filtering) and PromotePackage (copy or move a package between same-namespace repositories) — including backend Go implementations, frontend TypeScript mappers, tests, and documentation.

Concerns

• ListPackagesWithFilters fetches all pages with no upper bound; large repos could cause memory pressure or timeouts.
• Cross-namespace owner mismatch is only caught in Execute, not in Setup; users see the error at run time, not configuration time.
• PromotePackage emits the full Package struct; ListPackages trims fields, but PromotePackage does not — inconsistent output verbosity.
• Execute switch default falls through to CopyPackage for any unrecognised mode value, bypassing the invalid-mode guard from Setup.

Recommended reviewers: bender-rodriguez-unit1