> ## Documentation Index
> Fetch the complete documentation index at: https://docs.entire.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Push from GitHub Actions

> Let a GitHub Actions workflow push to Entire as a service account, without storing a secret.

A GitHub Actions workflow can push to Entire without a stored token. The workflow does it with the help of GitHub's OIDC token and Entire trades that token for a short-lived service-account token.

You set this up once per workflow:

1. Create a service account in your Entire project.
2. Give the service account access to a repository.
3. Bind the service account to the GitHub repository that runs the workflow.
4. Add the `entireio/setup-entire` action to the workflow.

You can also do the first three steps in entire.com. See [Service Accounts in entire.com](https://docs.entire.com/guides/configuration/service-accounts.md#create-a-service-account-in-entire-com).

> [!NOTE]
>
> You need permission to manage the Entire project.

## Create a Service Account

```bash theme={null}
entire sa create my-project ci
```

The command prints the service account's `svc_` ID. This is needed for the workflow.

By default, each project owner can have up to 5 service accounts, across all its projects. You can use one service account for each purpose.

## Grant Access to a Repository

To give the service account a role on a repository in the same project, use the command:

```bash theme={null}
entire sa grant my-project/ci --repo my-repo --role writer
```

You need to use `reader` for a workflow that only fetches and `writer` for a workflow that pushes. A service account can only get access inside its own project.

## Bind a GitHub Repository

To bind the service account to the GitHub repository whose workflows act as it, use the command:

```bash theme={null}
entire sa bind my-project/ci --provider github-actions --pin repository=my-gh-org/my-gh-repo
```

The `repository` pin names one exact `owner/repo`. A service account has one GitHub binding.

To limit which workflows can sign in, such as one workflow file on `main`, add more pins. See [GitHub Actions](https://docs.entire.com/guides/configuration/oidc.md#github-actions) for every pin and which to use.

## Add the Workflow

Add `entireio/setup-entire` before the steps that use Entire. The job needs `id-token: write`:

```yaml theme={null}
name: push-to-entire

on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  push:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: entireio/setup-entire@v1
        with:
          service-account: svc_01M6JDV1WP4PTGV5WBVAQDX3K5
      - run: git push entire://aws-us-east-2.entire.io/et/my-project/my-repo HEAD:main
```

Use your repository's `entire://` URL in the last step.

The action installs `entire` and `git-remote-entire`. It then exports the service-account token as `ENTIRE_TOKEN`, so later `git` and `entire` commands use it.

The token lives 45 minutes. A job that runs longer must run the action again.

See the [action's README](https://github.com/entireio/setup-entire) for all inputs and outputs.

## Troubleshooting

* **No OIDC token**: the workflow or job lacks `permissions: id-token: write`, or the run is a pull request from a fork. GitHub gives fork runs no OIDC token.
* **Token exchange failed (HTTP 400)**: the service account has no binding, or the binding does not match the workflow. Check the `repository` pin and any other pins.
* **Repository not found** when you push: the service account has no role on that repository.
* **Anything else**: see [Service Account Troubleshooting](https://docs.entire.com/guides/configuration/service-accounts-troubleshooting.md).

## Remove Access

Remove the binding to stop the workflow from acting as the service account:

```bash theme={null}
entire sa bindings my-project/ci
entire sa unbind my-project/ci <binding-id>
```

Delete the service account to remove its access and bindings together:

```bash theme={null}
entire sa delete my-project/ci
```