Skip to main content

CI integration

External CI is optional. Use it when your pipeline already owns release orchestration, or when checks outside Pagifier must finish before an archive is handed over. If you mostly want “merge code, build it,” Deploy from Git has less plumbing.

This is still the developer side of the boundary: your platform team gives you PAGIFIER_URL and a narrowly scoped token; you keep the project file and pipeline step with the application. The token should not carry Git provider credentials or cluster access.

The raw integration is one authenticated HTTP call, and the platform can publish reusable steps so application pipelines stay one line.

GitHub Actions​

Use the composite action published by your platform team (source: examples/ci/github-action in the Pagifier repository):

- uses: company/pagifier-deploy@v1
  with:
    config: frontend/pagifier.toml
    environment: prod
    token: ${{ secrets.PAGIFIER_TOKEN }}

The action validates the configuration first (fast failure with readable errors annotated on the PR), zips the workspace, uploads with ?wait=true, streams build/deploy progress into the job log, fails the job with the build log inline on error, and exports the deployed URL as an output.

Jenkins​

The shared-library step (examples/ci/jenkins) has the same flow:

pagifierDeploy(
  config: 'frontend/pagifier.toml',
  environment: 'prod',
  credentialsId: 'pagifier-token',
)

Any other CI​

Three commands work everywhere:

# 1. Validate (fail the PR early)
curl --fail-with-body -sS -H "Authorization: Bearer $PAGIFIER_TOKEN" \
     --data-binary @pagifier.toml "$PAGIFIER_URL/v1/validate"

# 2. Package
zip -qr app.zip . -x '.git/*' -x 'node_modules/*'

# 3. Deploy and wait
curl --fail-with-body -sS -N -H "Authorization: Bearer $PAGIFIER_TOKEN" \
     -F config=@pagifier.toml -F archive=@app.zip \
     "$PAGIFIER_URL/v1/applications/$APP/environments/$ENV/deployments?wait=true"

The ?wait=true stream is newline-delimited JSON. The final line carries done: true plus success, the app url, and — on build failure — the tail of the build log, so your pipeline needs no polling loop and no kubectl access to debug a red deploy.

Building in CI instead of in-cluster​

If your pipeline already builds the artifact, skip the in-cluster build:

build: false
artifact: dist

Zip the built output and upload as usual. Pagifier still packages it into a content-addressed OCI image, verifies its digest, and (when configured) signs it.

Signed artifacts​

Tenants with a signing policy sign the archive in CI and pass the signature:

cosign sign-blob --key cosign.key app.zip > app.sig
curl ... -F signature=@app.sig ...

Unsigned uploads are rejected with 403 signature_required when the policy demands it. See supply-chain security.