GitHub Actions

Publish npm packages, NuGet packages, and Docker images to DepAegis directly from your GitHub Actions workflows. This guide covers token setup, example workflows, caching, and release automation.

Setting Up Your DepAegis Token

Store your DepAegis Personal Access Token as a GitHub secret so workflows can authenticate without exposing credentials.

1. Create a token in the DepAegis dashboard under Settings → Access Tokens. Use the Read & Write scope for publishing, or Read Only for install-only workflows.
2. In your GitHub repository, go to Settings → Secrets and variables → Actions.
3. Click New repository secret. Name it DEPAEGIS_TOKEN and paste the token value.

Publishing npm Packages

A minimal workflow that publishes an npm package when you push a version tag:

# .github/workflows/publish-npm.yml
name: Publish npm Package

on:
  push:
    tags:
      - "v*"

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          registry-url: "https://app.depaegis.com/"

      - run: npm ci

      - run: npm run build

      - run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.DEPAEGIS_TOKEN }}

Publishing NuGet Packages

Build and push a .NET package to DepAegis after a version tag:

# .github/workflows/publish-nuget.yml
name: Publish NuGet Package

on:
  push:
    tags:
      - "v*"

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "10.0.x"

      - run: dotnet pack MyPackage.csproj -c Release -o ./artifacts

      - run: |
          dotnet nuget push ./artifacts/*.nupkg \
            --source "https://nuget.app.depaegis.com/api/v1/nuget/v3/index.json" \
            --api-key "${{ secrets.DEPAEGIS_TOKEN }}" \
            --skip-duplicate

Pushing Docker Images

Build and push a Docker image to the DepAegis container registry:

# .github/workflows/publish-docker.yml
name: Publish Docker Image

on:
  push:
    tags:
      - "v*"

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Log in to DepAegis Container Registry
        uses: docker/login-action@v3
        with:
          registry: app.depaegis.com
          username: "${{ github.actor }}"
          password: "${{ secrets.DEPAEGIS_TOKEN }}"

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            app.depaegis.com/my-org/my-app:${{ github.ref_name }}
            app.depaegis.com/my-org/my-app:latest

OIDC Keyless Authentication (Experimental)

DepAegis supports OpenID Connect (OIDC) for keyless authentication with GitHub Actions. Instead of storing a long-lived token, the workflow exchanges a short-lived JWT from GitHub for a DepAegis access token.

Setup

1. In the DepAegis dashboard, go to Organization → Settings → OIDC and add a GitHub Actions trust policy. Specify the repository (or * for all repos) and allowed branches.
2. In your workflow, request the GitHub OIDC token and exchange it:

# .github/workflows/publish-oidc.yml
name: Publish with OIDC

on:
  push:
    branches: [main]

permissions:
  id-token: write   # Required for OIDC

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Exchange OIDC token for DepAegis token
        id: depaegis-auth
        uses: depaegis/action-oidc-auth@v1
        with:
          registry: app.depaegis.com
          org: my-org

      - name: Publish
        run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{ steps.depaegis-auth.outputs.token }}

Caching Packages

Speed up your workflows by caching package downloads between runs.

# Add to your workflow job steps
- name: Cache npm
  uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-npm-

# setup-dotnet action caches automatically, but for explicit control:
- name: Cache NuGet
  uses: actions/cache@v4
  with:
    path: ~/.nuget/packages
    key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }}
    restore-keys: |
      ${{ runner.os }}-nuget-

# Use buildx with cache-to/cache-from
- name: Build and push with cache
  uses: docker/build-push-action@v6
  with:
    context: .
    push: true
    tags: app.depaegis.com/my-org/my-app:latest
    cache-from: type=gha
    cache-to: type=gha,mode=max

Full Release Workflow Example

A complete workflow that runs tests, publishes an npm package, pushes a Docker image, and creates a GitHub release:

# .github/workflows/release.yml
name: Release

on:
  push:
    tags: ["v*"]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
      - run: npm ci
      - run: npm test

  publish-npm:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          registry-url: "https://app.depaegis.com/"
      - run: npm ci
      - run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.DEPAEGIS_TOKEN }}

  publish-docker:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: app.depaegis.com
          username: "${{ github.actor }}"
          password: "${{ secrets.DEPAEGIS_TOKEN }}"
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            app.depaegis.com/my-org/my-app:${{ github.ref_name }}
            app.depaegis.com/my-org/my-app:latest

  release:
    needs: [publish-npm, publish-docker]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true

Branch Protection & Release Automation

To ensure only reviewed code gets published:

1. Protect your main branch— require pull request reviews and status checks before merging.
2. Use tag-based triggers — publish only when a version tag (v*) is pushed. Tags on protected branches require maintainer permissions.
3. Automate tag creation— use a workflow that bumps the version, creates a tag, and pushes it:

# .github/workflows/tag-and-release.yml
name: Create Release Tag

on:
  push:
    branches: [main]

jobs:
  tag:
    runs-on: ubuntu-latest
    if: "!contains(github.event.head_commit.message, 'skip ci')"
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
      - run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          npm version patch -m "chore: release %s"
          git push --follow-tags