GitHub Actions

OrcaCD supports triggering deployments directly from GitHub Actions using GitHub's OIDC tokens. This means you don't need to store any long-lived credentials in your repository secrets. The identity of the workflow is verified cryptographically.

Prerequisites

• A GitHub repository connected in OrcaCD with provider type GitHub
• The OrcaCD Hub must be reachable from GitHub's network.

Example Workflow

Add a step at the end of your CI workflow to notify OrcaCD after a successful build or image push:

permissions:
  id-token: write

- uses: OrcaCD/deploy-action@... # Replace ... with the latest version or hash
  with:
    # The OrcaCD hub URL (required)
    # Required
    hub: https://orca.example.com

    # Whether to sync the repo content (compose files)
    # Optional, default: true
    syncRepo: true

    # Whether to pull the latest container image versions,
    # even it the compose file has not changed
    # Optional, default: false
    pullImages: false

Use Cases

• Trigger on tag creation to deploy a new version of your application when a new release is created
• To deploy a new version of a mutable image (e.g. latest) after a successful build and push to the registry

How It Works

When a GitHub Actions workflow runs, it requests a short-lived OIDC token from GitHub. OrcaCD verifies this token against GitHub's public OIDC endpoint and checks that:

1. The token's repository claim matches a GitHub repository registered in OrcaCD with GitHub Actions OIDC enabled.
2. The workflow was not triggered by a pull_request or pull_request_target event (to prevent untrusted forks from triggering deployments).

If verification succeeds, OrcaCD finds all applications linked to the matching repository and branch, then dispatches the requested actions.