GetGitOps CLI Action

Installs the GitOps Platform CLI (gops) and runs it in your GitHub Actions workflows: code security reports, vault secret exports and secret management.

- uses: getgitops/cli-github-action@v1
  with:
    command: creport scan
    api-key: ${{ secrets.GITOPS_API_KEY }}
    service: my-service
    project: my-project

Usage

Code report scan

Runs Trivy, Syft and Gitleaks on the repository and uploads the results. Git metadata (branch, commit, author, repository URL and ref) is detected from the GitHub context, pull requests included. The scanners are cached between runs.

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: getgitops/cli-github-action@v1
        with:
          command: creport scan
          api-key: ${{ secrets.GITOPS_API_KEY }}
          service: my-service
          project: my-project
          tags: github-actions, ci

Load vault secrets as environment variables

With export-env: true every secret is masked in the logs and available as an environment variable in the following steps of the job.

- uses: getgitops/cli-github-action@v1
  with:
    command: vault export
    api-key: ${{ secrets.GITOPS_API_KEY }}
    project-id: 00000000-0000-0000-0000-000000000000
    path: /
    environment: production
    export-env: true

- run: ./deploy.sh # DATABASE_URL, API_TOKEN... are available here

Export vault secrets to a file

- uses: getgitops/cli-github-action@v1
  with:
    command: vault export
    api-key: ${{ secrets.GITOPS_API_KEY }}
    project-id: 00000000-0000-0000-0000-000000000000
    environment: production
    format: json
    output: secrets.json

- run: jq 'keys' secrets.json

Warning

The file contains plain-text secrets. Don't upload it as an artifact or include it in a Docker build context unless that's intended.

Run a command with the secrets injected

The secrets are only visible to that command.

- uses: getgitops/cli-github-action@v1
  with:
    command: vault run
    api-key: ${{ secrets.GITOPS_API_KEY }}
    project-id: 00000000-0000-0000-0000-000000000000
    environment: production
    run: npm run migrate

Manage a secret

command accepts vault secret create, vault secret get, vault secret update and vault secret delete.

- uses: getgitops/cli-github-action@v1
  with:
    command: vault secret update
    api-key: ${{ secrets.GITOPS_API_KEY }}
    project-id: 00000000-0000-0000-0000-000000000000
    path: /database
    key: DB_PASSWORD
    environment: production
    value: ${{ secrets.NEW_DB_PASSWORD }}

Install only

Without command the action only installs the CLI and adds gops to the PATH, so you can call it from your own steps.

- uses: getgitops/cli-github-action@v1
  with:
    version: 1.2.1

- run: gops --help

Inputs

Input	Commands	Default	Description
command			creport scan, vault export, vault run, vault secret create|get|update|delete, tools install. Empty: install only.
version	all	latest	Version, dist-tag or semver range of @getgitops/cli.
api-url	all	https://cloud.getgitops.com/api	GitOps Platform API base URL.
api-key	all except tools install		API key. Use a secret.
working-directory	all	.	Directory the command runs in.
args	all		Extra CLI arguments, one per line.
service	creport scan		Service slug.
project	creport scan		Project slug.
tags	creport scan		Tags separated by commas, spaces or new lines.
git-branch, git-commit, git-repo-url, git-author, git-version	creport scan	detected	Override the git metadata detected from the GitHub context.
cache-tools	creport scan, tools install	true	Cache the scanners between runs.
project-id	vault *		Project ID.
path	vault *	/	Vault path.
environment	vault export, vault run, vault secret create|update		Vault environment slug.
format	vault export	env	env or json.
output	vault export		File the secrets are written to. Required unless export-env is true.
export-env	vault export	false	Export the secrets as masked environment variables for the next steps.
run	vault run		Shell command run with the secrets injected.
key	vault secret *		Secret key.
value	vault secret create|update		Secret value. Masked in the logs.
secret-description	vault secret create|update		Secret description.

Outputs

Output	Description
version	Installed version of @getgitops/cli.
output-file	vault export: absolute path of the exported file (only when output is set).

Requirements

• Linux or macOS runners (x64 or arm64). Windows is not supported.
• Node.js 20 or later. If the runner doesn't have it, the action sets it up with actions/setup-node.

Security

• Inputs are passed to the CLI as environment variables, never interpolated into shell scripts, so they can't inject commands.
• api-key, value and every secret exported with export-env are masked in the logs.
• Pin the action to a full version (@v1.0.0) or a commit SHA if you need reproducible builds; @v1 follows the latest v1.x.y release.

Releasing

1. Create a release with a vX.Y.Z tag and select Publish this Action to the GitHub Marketplace.
2. The Update major tag workflow moves vX to the new release.

License

MIT