GitHub Actions Reference

Skiff2 provides reusable GitHub Actions for building and deploying your services. All actions are hosted in the allenai/skiff2-actions repo and pinned to @main.

Variables

After your project is provisioned, these GitHub Actions variables are automatically set on your repo:

Variable	Description
`SKIFF2_PROJECT_ID`	Your GCP project ID
`SKIFF2_WORKLOAD_IDENTITY_PROVIDER`	Workload Identity Federation provider for keyless GCP auth
`SKIFF2_SERVICE_ACCOUNT`	Service account email used for GCP operations

`setup` action

Path: allenai/skiff2-actions/shared-actions/setup@main

Authenticates to Google Cloud and configures Docker for Container Registry. Must run before build or deploy.

Inputs

Input	Required	Default	Description
`workload_identity_provider`	Yes	—	Workload Identity Provider resource name
`service_account`	Yes	—	Service account email to impersonate
`project_id`	Yes	—	GCP project ID

Example

- name: Skiff2 Setup
  id: setup
  uses: allenai/skiff2-actions/shared-actions/setup@main
  with:
      workload_identity_provider: ${{ vars.SKIFF2_WORKLOAD_IDENTITY_PROVIDER }}
      service_account: ${{ vars.SKIFF2_SERVICE_ACCOUNT }}
      project_id: ${{ vars.SKIFF2_PROJECT_ID }}

`build` action

Path: allenai/skiff2-actions/shared-actions/build@main

Builds Docker images for each service defined in skiff2.json and pushes them to GCR.

Inputs

Input	Type	Required	Default	Description
`project_id`	String	Yes	—	GCP project ID
`config_file`	String	No	`skiff2.json`	Path to config file relative to repo root
`registry`	String	No	`gcr.io`	Docker registry
`region`	String	No	`us-west1`	GCP region
`repo_name`	String	No	`github.event.repository.name`	Repository name for image tagging
`commit_sha`	String	No	`github.sha`	Commit SHA to tag images with
`branch_name`	String	No	`github.ref_name`	Branch name to tag images with
`services`	CSV	No	(all services)	Comma-separated list of service names to build
`build_args`	List	No	-	List of build-time variables
`secrets`	List	No	—	Build-time secrets to expose (`key=${{ secrets.VALUE }}`, one per line). Passed as `--secret id=key` to `docker buildx`. Use `RUN --mount=type=secret,id=key` in your Dockerfile.
`secret_envs`	List/CSV	No	—	Build-time secrets sourced from runner environment variables (`key=ENV_VAR_NAME`, one per line). The env var must already be set in the job environment.
`secret_files`	List	No	—	Build-time secrets sourced from files (`key=./path/to/file`, one per line). Passed as `--secret id=key,src=file`.
`push`	Boolean	No	`true`	Pushes the built artifacts to a registry
`cache_from`	String	No	`type=registry,ref=${DOCKER_REGISTRY}/${PROJECT_ID}/${SERVICE_NAME}:${BRANCH}-buildcache`	List of external cache sources for buildx (e.g., user/app:cache, type=local,src=path/to/dir). Replaces ${DOCKER_REGISTRY}, ${PROJECT_ID}, ${SERVICE_NAME}, ${BRANCH} with corresponding values.
`cache_to`	String	No	`type=registry,ref=${DOCKER_REGISTRY}/${PROJECT_ID}/${SERVICE_NAME}:${BRANCH}-buildcache,mode=max`	List of cache export destinations for buildx (e.g., user/app:cache, type=local,dest=path/to/dir). Replaces ${DOCKER_REGISTRY}, ${PROJECT_ID}, ${SERVICE_NAME}, ${BRANCH} with corresponding values.

Input Types

List type is a newline-delimited string
cache-from: |
  user/app:cache
  type=local,src=path/to/dir

CSV type is a comma-delimited string
tags: name/app:latest,name/app:1.0.0

Outputs

Output	Description
`built-images`	JSON object mapping service names to their built image tags

Example

- name: Skiff2 Build
  id: build
  uses: allenai/skiff2-actions/shared-actions/build@main
  with:
      project_id: ${{ vars.SKIFF2_PROJECT_ID }}

`deploy-infra` action

Path: allenai/skiff2-actions/shared-actions/deploy-infra@main

Deploys shared infrastructure (load balancer, URL map, NEGs, SSL certificates) for all environments. Only needs to run on main branch pushes. This action should NOT be included in the deploy workflow for remoteRepos listed in the project config.

Inputs

Input	Required	Default	Description
`project_id`	Yes	—	GCP project ID
`command`	No	`plan`	`plan` or `apply`
`config_file`	No	`skiff2.json`	Path to config file relative to repo root
`region`	No	`us-west1`	GCP region
`repo_name`	No	`github.event.repository.name`	Repository name

Outputs

Output	Description
`default_url`	Default load balancer URL for the project

Example

- name: Skiff2 Deploy Infra
  if: github.ref_name == 'main'
  uses: allenai/skiff2-actions/shared-actions/deploy-infra@main
  with:
      project_id: ${{ vars.SKIFF2_PROJECT_ID }}
      command: apply

`deploy-services` action

Path: allenai/skiff2-actions/shared-actions/deploy-services@main

Deploys Cloud Run services for a single environment. Uses Terraform workspaces for branch isolation — main branch uses the default workspace, other branches get their own workspace.

Inputs

Input	Required	Default	Description
`project_id`	Yes	—	GCP project ID
`command`	No	`plan`	`plan` or `apply`
`config_file`	No	`skiff2.json`	Path to config file relative to repo root
`region`	No	`us-west1`	GCP region
`repo_name`	No	`github.event.repository.name`	Repository name
`environment`	No	`github.ref_name`	Target environment to deploy (e.g. `main`, `qa`)
`services`	No	(all services)	Comma-separated list of services to deploy

Outputs

Output	Description
`default_url`	Default load balancer URL for the project

Example

- name: Skiff2 Deploy Services
  id: deploy-services
  uses: allenai/skiff2-actions/shared-actions/deploy-services@main
  with:
      project_id: ${{ vars.SKIFF2_PROJECT_ID }}
      command: apply

Full workflow example

A typical deployment workflow for a project with a single service:

.github/workflows/deploy.yml
name: Skiff2 Build & Deploy
on:
    push:
        branches:
            - main # will need to add more branches here if you plan on deploying to other environments.

# needed to authenticate with google
permissions:
    contents: read
    id-token: write

concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: false

jobs:
    build_deploy:
        runs-on: ubuntu-latest
        environment:
            name: ${{ github.ref_name }}
            url: ${{ steps.deploy-services.outputs.default_url }}
        steps:
            - name: Skiff2 Setup
              id: setup
              uses: allenai/skiff2-actions/shared-actions/setup@main
              with:
                  workload_identity_provider: ${{ vars.SKIFF2_WORKLOAD_IDENTITY_PROVIDER }} # prepopulated on project setup
                  service_account: ${{ vars.SKIFF2_SERVICE_ACCOUNT }} # prepopulated on project setup
                  project_id: ${{ vars.SKIFF2_PROJECT_ID }} # prepopulated on project setup

            - name: Skiff2 Build
              id: build
              uses: allenai/skiff2-actions/shared-actions/build@main
              with:
                  project_id: ${{ vars.SKIFF2_PROJECT_ID }}

            - name: Skiff2 Deploy Infra
              if: github.ref_name == 'main'
              uses: allenai/skiff2-actions/shared-actions/deploy-infra@main
              with:
                  project_id: ${{ vars.SKIFF2_PROJECT_ID }}
                  command: apply

            - name: Skiff2 Deploy Services
              id: deploy-services
              uses: allenai/skiff2-actions/shared-actions/deploy-services@main
              with:
                  project_id: ${{ vars.SKIFF2_PROJECT_ID }}
                  command: apply

Variables​

setup action​

Inputs​

Example​

build action​

Inputs​

Input Types​

Outputs​

Example​

deploy-infra action​

Inputs​

Outputs​

Example​

deploy-services action​

Inputs​

Outputs​

Example​

Full workflow example​

Variables

`setup` action

Inputs

Example

`build` action

Inputs

Input Types

Outputs

Example

`deploy-infra` action

Inputs

Outputs

Example

`deploy-services` action

Inputs

Outputs

Example

Full workflow example