Push from GitHub Actions

A GitHub Actions workflow can push to Entire without a stored token. The workflow does it with the help of GitHub’s OIDC token and Entire trades that token for a short-lived service-account token. You set this up once per workflow:

Create a service account in your Entire project.
Give the service account access to a repository.
Bind the service account to the GitHub repository that runs the workflow.
Add the entireio/setup-entire action to the workflow.

You can also do the first three steps in entire.com. See Service Accounts in entire.com.

You need permission to manage the Entire project.

Create a Service Account

entire sa create my-project ci

The command prints the service account’s svc_ ID. This is needed for the workflow. By default, each project owner can have up to 5 service accounts, across all its projects. You can use one service account for each purpose.

Grant Access to a Repository

To give the service account a role on a repository in the same project, use the command:

entire sa grant my-project/ci --repo my-repo --role writer

You need to use reader for a workflow that only fetches and writer for a workflow that pushes. A service account can only get access inside its own project.

Bind a GitHub Repository

To bind the service account to the GitHub repository whose workflows act as it, use the command:

entire sa bind my-project/ci --provider github-actions --pin repository=my-gh-org/my-gh-repo

The repository pin names one exact owner/repo. A service account has one GitHub binding. To limit which workflows can sign in, such as one workflow file on main, add more pins. See GitHub Actions for every pin and which to use.

Add the Workflow

Add entireio/setup-entire before the steps that use Entire. The job needs id-token: write:

name: push-to-entire

on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  push:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: entireio/setup-entire@v1
        with:
          service-account: svc_01M6JDV1WP4PTGV5WBVAQDX3K5
      - run: git push entire://aws-us-east-2.entire.io/et/my-project/my-repo HEAD:main

Use your repository’s entire:// URL in the last step. The action installs entire and git-remote-entire. It then exports the service-account token as ENTIRE_TOKEN, so later git and entire commands use it. The token lives 45 minutes. A job that runs longer must run the action again. See the action’s README for all inputs and outputs.

Troubleshooting

No OIDC token: the workflow or job lacks permissions: id-token: write, or the run is a pull request from a fork. GitHub gives fork runs no OIDC token.
Token exchange failed (HTTP 400): the service account has no binding, or the binding does not match the workflow. Check the repository pin and any other pins.
Repository not found when you push: the service account has no role on that repository.
Anything else: see Service Account Troubleshooting.

Remove Access

Remove the binding to stop the workflow from acting as the service account:

entire sa bindings my-project/ci
entire sa unbind my-project/ci <binding-id>

Delete the service account to remove its access and bindings together:

entire sa delete my-project/ci

Getting Started

Guides

Integrations

Migration

Security

Resources

Push from GitHub Actions

Create a Service Account

Grant Access to a Repository

Bind a GitHub Repository

Add the Workflow

Troubleshooting

Remove Access

​Create a Service Account

​Grant Access to a Repository

​Bind a GitHub Repository

​Add the Workflow

​Troubleshooting

​Remove Access

Create a Service Account

Grant Access to a Repository

Bind a GitHub Repository

Add the Workflow

Troubleshooting

Remove Access