Reoclo Github Actions

Reoclo GitHub Actions

Reoclo publishes four composable Actions for CI/CD. They run on GitHub Actions and on Gitea Actions. Each one authenticates with a Reoclo automation key (rca_...), which you set as the REOCLO_API_KEY repository secret. Reoclo audits every operation.

Deploy with a command

- uses: reoclo/run@v2
  with:
    api_key: ${{ secrets.REOCLO_API_KEY }}
    server_id: ${{ secrets.REOCLO_SERVER_ID }}
    command: cd /srv/reoclo/myapp && docker compose pull && docker compose up -d
    timeout: 300

Load secrets from the Reoclo Secrets Manager

reoclo/load-secrets resolves every secret project you grant the key. It exports each secret to $GITHUB_ENV, so later steps read the values as ordinary environment variables. Each secret key becomes an environment variable name. The action masks every value in the log.

- name: Load secrets
  uses: reoclo/load-secrets@v1
  with:
    api_key: ${{ secrets.REOCLO_API_KEY }}
    # projects: production-api   # optional; the default loads every granted project

- name: Use them
  run: ./migrate.sh             # DB_URL, API_TOKEN, ... are now env vars

Grant the automation key each secret project on the project Access tab. The Read secrets operation alone grants no project.

Rules

• Set the automation key as the REOCLO_API_KEY repository secret. Never inline a key.
• Scope each key to the least it needs. Use a separate key per environment.
• reoclo/load-secrets is an Action. reoclo run is the CLI equivalent for any CI system. Both read the same Secrets Manager.
• reoclo/run@v2 runs a command on a server. It does not read the Secrets Manager. Its env: input passes CI values through as literals.
• The same YAML runs on Gitea Actions. Do not rewrite it.

Reference

Full inputs, outputs, and examples: GitHub Actions guide.