Automation and agents

GitHub Actions and OIDC

Upload from GitHub Actions with repository-scoped OIDC instead of a stored secret.

Before you start

Create a Blob Yard project.
Configure an active GitHub OIDC trust for the repository, workflow, ref, audience, project, and allowed actions.

Define the trust boundary

Create the trust from the workspace Settings page before the first run.
Trusts pin repository, ref glob, workflow path and ref, audience, and allowed actions.
An optional GitHub environment and project can narrow the trust further.
Revoking the trust invalidates machine sessions minted through it.
The normal OIDC path requires no stored Blob Yard token.

Add the upload action

GitHub Actions workflow

permissions:
  contents: read
  id-token: write

steps:
  - uses: actions/checkout@v7
  - uses: Reliability-Works/blobyard/.github/actions/upload@v1
    with:
      api-url: https://api.blobyard.com/v1
      path: ./report.zip
      project: release-files
      workspace: demo-team

The action is shell-only. It installs a checksum-verified native CLI release, requests GitHub OIDC identity, then exchanges it for a machine session lasting no more than 15 minutes.

Deploy a Web Yard

GitHub Actions Web Yard deploy

permissions:
  contents: read
  id-token: write

steps:
  - uses: actions/checkout@v7
  - uses: Reliability-Works/blobyard/.github/actions/upload@v1
    with:
      operation: deploy
      path: ./apps/docs/dist
      project: documentation
      public: true
      workspace: demo-team
      yard: product-docs

A Web Yard deploy uses the same repository-scoped OIDC exchange. Grant yard:manage to the trust, build the static directory before this step, and set public: true to acknowledge that every deployed file becomes public.

Consume immutable outputs

Artifact uploads output an immutable URI and version. Optional sharing returns a one-time share URL. A single Web Yard deploy outputs the stable yard-url, immutable deployment-url, deploy-id, and status. Multi-Yard deploys return both URLs in a compact JSON result array. Pull request comments additionally require pull-requests: write and use the workflow's existing GitHub token.

Reference and troubleshooting

Syntax and behavior

Reusable syntax

reusable action step

- uses: Reliability-Works/blobyard/.github/actions/upload@v1
  with:
    api-url: <versioned-api-url>
    path: <single-local-file>
    project: <project-slug>
    workspace: <workspace-slug>

Concrete example

OIDC upload workflow

permissions:
  contents: read
  id-token: write

steps:
  - uses: actions/checkout@v7
  - uses: Reliability-Works/blobyard/.github/actions/upload@v1
    with:
      api-url: https://api.blobyard.com/v1
      path: ./report.zip
      project: release-files
      workspace: demo-team

Values used

id-token: write: Allows GitHub to issue the OIDC assertion. It does not grant repository write access.
./report.zip: One local runner file. Archive a directory before using the action.
release-files and demo-team: Remote project and workspace slugs covered by the configured trust.
api-url: Stable versioned Blob Yard API base ending in /v1.

Expected result

The action returns an immutable object URI and version. Optional sharing also returns a one-time public URL.

If it fails

Confirm id-token: write is declared when OIDC issuance fails.
Match repository, ref, workflow path, audience, project, and allowed action against the active trust.

Security and lifecycle

The normal path mints a repository-scoped machine session for no more than 15 minutes. No permanent Blob Yard secret is stored in GitHub.