ci-cd

git-clone Action

A GitHub Action that clones multiple git repositories with specific features.

Usage

This action can be used in other repositories' workflows to clone multiple repositories with branch/tag selection support.

Inputs:

• repo-list (required): Space-separated list of repositories in org/repo format to clone
• git-pat (optional): Git Personal Access Token for authentication
• default-repo-ref (optional): Default Git reference to check out
• pyproject-path (optional): Path to the pyproject.toml file

Example workflow:

- uses: bopen/ci-cd/git-clone
  env:
    REPO1_REF: "main"
    REPO2_REF: "v1.0.0"
  with:
    repo-list: "org/repo1 org/repo2"
    git-pat: ${{ secrets.GIT_PAT }}
    default-repo-ref: main
    pyproject-path: pyproject.toml

Features

• Clones multiple repositories in a single action step
• Supports branch/tag selection per repo via environment variables (e.g., REPO_NAME_REF)
• Handles authentication via PAT

setup-deploy Action

A GitHub Action that sets up a deployment repository by cloning the repository itself and all its dependencies.

Usage

This action can be used in workflows to prepare a deployment environment by cloning the main repository and its dependencies.

Inputs:

• repo (required): The main repository in org/repo format to clone
• deps-list (required): Space-separated list of dependencies in org/repo format to clone alongside the main repository
• deps-versions-file (required): Path to a file containing the versions of the dependencies to clone
• git-pat (optional): Git Personal Access Token for authentication

Example workflow:

  - uses: bopen/ci-cd/setup-deploy@main
    with:
      repo: org/main-repo
      deps-list: "org/dependency1 org/dependency2"
      deps-versions-file: org/main-repo/environment.release
      git-pat: ${{ secrets.GIT_PAT }}

update-dependency-file Action

A GitHub Action that updates a dependency file with the specified version of specified dependency.

Usage

This action can be used in workflows to update a dependency file with the new version of a specified dependency.

Inputs:

• package-ref (required): The reference to the package in the dependency file
• version (required): The version to update the dependency to
• deps-versions-file (required): The file containing the dependency information

Example workflow:

  - name: Update dependency file
    uses: bopen/ci-cd/update-dependency-file@main
    with:
      package-ref: PACKAGE_NAME_REF
      version: v1.0
      deps-versions-file: environment.release

check-update-uv-lock Action

A GitHub Action that checks if the uv.lock file is up to date and updates it if necessary.

Usage

This action can be used in workflows to ensure that the uv.lock file is correct and updated if needed.

Inputs:

• repo-path (required): The path to the repository containing the uv.lock file Outputs:
• uv-lock: Boolean indicating whether the uv.lock file has been updated

Example workflow:

  - name: Check and update uv lock
    id: check-update-uv-lock
    uses: bopen/ci-cd/check-update-uv-lock@main
    with:
      repo-path: path/to/repository

copy-git-clone-script Action

A GitHub Action that copies the git-clone-ref.py script into a directory of the calling repository.

Usage

Inputs:

• target-path (required): The directory where git-clone-ref.py should be copied

Example workflow:

  - name: Copy git clone script
    uses: bopen/ci-cd/copy-git-clone-script@main
    with:
      target-path: scripts

Scripts

The scripts backing the actions live in src/ci_cd and are packaged as a uv project, so they can also be run locally:

• git-clone-ref: clones multiple repositories (used by the git-clone action)
• get-kube: downloads a kubeconfig from Proton Pass

get-kube

Downloads the kubeconfig of a Kubernetes environment stored in Proton Pass, using the pass-cli command-line tool.

Each project is a Proton Pass vault, and each environment is an item in that vault with the kubeconfig as its only attachment.

Requirements:

• pass-cli installed and on PATH
• Logged in with pass-cli login

Options:

• -p, --project (required, env CICD_PROJECT): Name of the vault containing the kubeconfig
• -e, --environment (required, env CICD_ENVIRONMENT): Name of the item holding the kubeconfig
• -o, --output-path (optional, env CICD_OUTPUT_PATH): Where to save the kubeconfig. Defaults to local.<environment>.kubeconfig.yaml in the current directory, with spaces replaced by _

Example:

uv run get-kube -p my-project -e "production eu"
export KUBECONFIG=$PWD/local.production_eu.kubeconfig.yaml

The file is saved readable only by its owner (0600), since it contains cluster credentials. Running uv run get-kube with no arguments prints the help.

License

Copyright 2026, B-Open Solutions srl.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.