Actions

Rebasely Actions runs your CI on every push and pull request. Workflows live in .rebasely/workflows/, each job runs in its own Cloudflare Sandbox, and every job reports a check on the commit.

01Your first workflow#

1. Add a workflow file#

   Create .rebasely/workflows/ci.yml:

   .rebasely/workflows/ci.yml

   name: ci
   on:
     push:
       branches: ["**"]
     pull_request:
       branches: [main]
   jobs:
     test:
       runs-on: { image: node24, instance: lite }
       steps:
         - uses: duragit/checkout@v1
         - uses: duragit/cache@v1
           with:
             key: npm
             key-files: [package-lock.json]
             paths: [~/.npm]
         - run: npm ci
         - run: npm test

2. Push it#

   Shell

   git add .rebasely/workflows/ci.yml
   git commit -m "Add CI"
   git push

3. Watch the run#

   The repository's Actions tab lists the run; a job's page streams its log live. From a terminal:

   Shell

   rebasely runs list
   rebasely runs logs <run> --follow

A repository that still has a .duragit/workflows folder keeps working: Rebasely reads .rebasely/workflows when it exists, and the old folder otherwise.

02When workflows run#

git push -o ci.skip starts nothing. Workflow syntax has every filter.

03Runners: images and instances#

Each job starts a fresh container from its image on Cloudflare Sandboxes (Linux, x86_64), works in /workspace, and is gone when the job ends. runs-on picks the image and the instance; the default is node24 on basic.

04Secrets#

Add secrets to an organization, a repository or a deployment environment in their Actions settings (it needs a recent confirmation with Google or a passkey). Values are write-only: nobody can read one back. A step gets a secret only when it names it:

- run: ./deploy.sh
  env:
    API_TOKEN: ${{ secrets.API_TOKEN }}

• An environment's secret wins over the repository's, which wins over the organization's.
• A secret can instead be bound to a host: the job sees a placeholder, and Rebasely adds the real value only to requests to that host.
• Values are masked in logs; write more values to mask, one per line, to $DURAGIT_MASK.
• Runs started by people who are not established writers, and every sandbox run, get no secrets.

05Who can start what#

A run is trusted when whoever started it is an established writer of the organization (an account 7 days old or verified). For a pull request, its author and everyone who pushed to it must be. An untrusted run waits until a different established writer approves it, at that commit, and then runs without secrets, without pushing, and on at most a basic instance.

06Network#

By default a job reaches the package registries it needs (npm, PyPI, crates.io, the Go proxy, Debian and Wolfi packages) for reading only. List more hosts under a job's egress; that needs a verified owner or a paid plan.

07Checks, logs and artifacts#

• Each job reports a commit status named duragit/<workflow>/<job>. Pull requests show them as checks, and branch protection can require them.
• Logs stream live and are kept 30 days on the free plan; a job's log is cut at 64 MiB.
• duragit/upload-artifact@v1 keeps files for 30 days; duragit/cache@v1 reuses dependencies between runs.
• Cancel a run from its page or with rebasely runs cancel <run>. A job that failed because of Rebasely itself is retried once.

rebasely runs list --branch main
rebasely runs logs <run> --job test --follow
rebasely dispatch deploy.yml --ref main --input target=staging

GET  /api/v1/repos/<org>/<repo>/actions/runs
POST /api/v1/repos/<org>/<repo>/actions/runs/<id>/cancel
POST /api/v1/repos/<org>/<repo>/actions/workflows/deploy.yml/dispatches