Github Action

kind: githubaction

Description

The Github Action crawler looks recursively for all Github Action workflows. Then for each of them, it tries to automate its update.

It currently support the following sources:

Manifest

Parameters

Name Type Description Required
actions array

actions allows to specify the accepted Composite Action names

default:

  - "*",
credentials object

Credentials allows to specify the credentials to use to authenticate to the git provider The ID of the credential must be the domain of the git provider to configure

default: empty

examples:

  autodiscovery:
    crawlers:
      github/action:
        credentials:
          "code.forgejo.com":
            kind: gitea
            token: xxx
          "github.com":
            kind: github
            token: '{{ requiredEnv "GITHUB_TOKEN" }}'
    app object
        clientid string ClientID represents the GitHub App client ID
        expirationtime string

Expiration represents the token expiration time in seconds The token is used during the entire execution of updatecli and should be valid for the entire duration of the run The minimum value is 600 seconds (10 minutes)

Default: 3600 (1 hour)
        installationid string InstallationID represents the GitHub App installation ID It is the same ID that you can find in the GitHub endpoint: https://github.com/settings/installation/
        privatekey string PrivateKey represents a PEM encoded private key It is recommended to use PrivateKeyPath instead of PrivateKey to avoid putting sensitive information in the configuration file If both PrivateKey and PrivateKeyPath are set, PrivateKey takes precedence
        privatekeypath string PrivateKeyPath represents the path to a PEM encoded private key If both PrivateKey and PrivateKeyPath are set, PrivateKey takes precedence It is recommended to use an environment variable to set the PrivateKeyPath value e.g. PrivateKeyPath: {{ requiredEnv “GITHUB_APP_PRIVATE_KEY_PATH” }} to avoid putting sensitive information in the configuration file
    kind string
    token string
credentialsdocker object CredentialsDocker provides a map of registry credentials where the key is the registry URL without scheme
    password string

password specifies the container registry password to use for authentication. Not compatible with token

	compatible:
		* source
		* condition
		* target

	default:
		by default credentials are fetch from the local environment such as `~/.docker/config.json`.

	remark:
		Not compatible with token
    token string

token specifies the container registry token to use for authentication.

	compatible:
		* source
		* condition
		* target

	default:
		by default credentials are fetch from the local environment such as `~/.docker/config.json`.

	remark:
		Not compatible with username/password
    username string

username specifies the container registry username to use for authentication.

	compatible:
		* source
		* condition
		* target

	default:
		by default credentials are fetch from the local environment such as `~/.docker/config.json`.

	remark:
		Not compatible with token
digest boolean

Digest provides parameters to specify if the generated manifest should use a digest instead of the branch or tag.

Remark: - The digest is only supported for GitHub Action and docker image tag update. Feel free to open an issue for the Gitea and Forgejo integration.
files array

files allows to specify the accepted Action workflow file name

default:

  - ".github/workflows/*.yaml",
  - ".github/workflows/*.yml",
  - ".gitea/workflows/*.yaml",
  - ".gitea/workflows/*.yml",
  - ".forgejo/workflows/*.yaml",
  - ".forgejo/workflows/*.yml",
ignore array

ignore allows to specify rule to ignore autodiscovery a specific GitHub action based on a rule

default: empty
    actions object

Actions specifies the list of artifacts to check

The key is the artifact name and the value is the artifact version

The artifact name must match the GitHub action name or the Docker image name. In case of a Docker image, it must have the prefix docker://

If the value is empty, then the artifact name is enough to match If the value is a valid Git branch, Git tag, release, a Docker image tag , then the artifact version must match the constraint
    path string Path specifies a Flux filepath pattern, the pattern requires to match all of name, not just a subpart of the path.
only array

only allows to specify rule to only autodiscover manifest for a specific GitHub action based on a rule

default: empty
    actions object

Actions specifies the list of artifacts to check

The key is the artifact name and the value is the artifact version

The artifact name must match the GitHub action name or the Docker image name. In case of a Docker image, it must have the prefix docker://

If the value is empty, then the artifact name is enough to match If the value is a valid Git branch, Git tag, release, a Docker image tag , then the artifact version must match the constraint
    path string Path specifies a Flux filepath pattern, the pattern requires to match all of name, not just a subpart of the path.
rootdir string

rootDir allows to specify the root directory from where looking for GitHub Action

default: empty
versionfilter object

versionfilter provides parameters to specify the version pattern used when generating manifest.

kind - semver versionfilter of kind semver uses semantic versioning as version filtering pattern accepts one of: prerelease - Updatecli tries to identify the latest prerelease whatever it means patch - Updatecli only handles patch version update minor - Updatecli handles patch AND minor version update minoronly - Updatecli handles minor version only major - Updatecli handles patch, minor, AND major version update majoronly - Updatecli only handles major version update a version constraint such as >= 1.0.0

kind - regex versionfilter of kind regex uses regular expression as version filtering pattern accepts a valid regular expression

example:

  versionfilter:
    kind: semver
    pattern: minor

and its type like regex, semver, or just latest.

More examples can be found at https://www.updatecli.io/docs/core/versionfilter/
    kind string specifies the version kind such as semver, regex, or latest
    pattern string specifies the version pattern according the version kind for semver, it is a semver constraint for regex, it is a regex pattern for time, it is a date format
    regex string specifies the regex pattern, used for regex/semver and regex/time. Output of the first capture group will be used.
    replaceall object replaceAll applies a regex replacement to version strings before filtering. This is useful for transforming versions (e.g., curl-8_15_0 to curl-8.15.0) before regex extraction.
        pattern string Pattern specifies the regex pattern to match for replacement
        replacement string Replacement specifies the replacement string (supports $1, $2, etc. for captured groups)
    strict boolean strict enforce strict versioning rule. Only used for semantic versioning at this time
⚠ This table is generated from the Updatecli codebase and may contain inaccurate data. Feel free to report them on github.com/updatecli/updatecli

Example

# updatecli.d/default.yaml
name: "githubaction autodiscovery"
scms:
  default:
    kind: git
    spec:
      url: https://github.com/updatecli/updatecli.git
      branch: "main"

autodiscovery:
  scmid: default
  crawlers:
    githubaction:
      spec:
        digest: true
        rootdir: ".github"
Last modified on September 5, 2025
Edit this page on GitHub
← Flux
Golang →