CI/CD with GitHub Actions

A good pipeline does three things: validate every pull request, show the plan so reviewers see what would change, and deploy when changes land.

Secrets and variables

In your repository settings:

Name	Kind	Value
`PAWABASE_URL`	variable	Your gateway address
`PAWABASE_DEPLOY_KEY`	secret	A secret key with the Deploy and configure preset
Any `env("…")` names (`ERP_SECRET`)	secret	Your webhook and hook secrets

Use a separate key per environment, scoped as narrowly as you can.

Pull requests: validate and plan

# .github/workflows/pawabase-check.yml
name: pawabase-check
on:
  pull_request:

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install pawabase-iac
      - run: pawabase validate
      - name: Show the plan against staging
        env:
          PAWABASE_URL: ${{ vars.PAWABASE_URL }}
          PAWABASE_ENV: staging
          PAWABASE_API_KEY: ${{ secrets.PAWABASE_STAGING_KEY }}
          ERP_SECRET: ${{ secrets.ERP_SECRET }}
        run: pawabase plan

validate needs no secrets. plan reads the environment, so it needs the key. Skip that step for pull requests from forks, which can’t see secrets.

Merge: deploy

# .github/workflows/pawabase-deploy.yml
name: pawabase-deploy
on:
  push:
    branches: [main]

jobs:
  staging:
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install pawabase-iac
      - run: pawabase validate
      - run: pawabase deploy --yes
        env:
          PAWABASE_URL: ${{ vars.PAWABASE_URL }}
          PAWABASE_ENV: staging
          PAWABASE_API_KEY: ${{ secrets.PAWABASE_STAGING_KEY }}
          ERP_SECRET: ${{ secrets.ERP_SECRET }}

  production:
    needs: staging
    runs-on: ubuntu-latest
    environment: production        # add required reviewers here
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install pawabase-iac
      - run: pawabase deploy --yes
        env:
          PAWABASE_URL: ${{ vars.PAWABASE_URL }}
          PAWABASE_ENV: production
          PAWABASE_API_KEY: ${{ secrets.PAWABASE_PRODUCTION_KEY }}
          ERP_SECRET: ${{ secrets.ERP_SECRET_PRODUCTION }}

GitHub environments let you require a reviewer before the production job runs, which is the right place for a human approval.

Good practice

Always run pawabase validate first.
Never use --mode override in CI unless code is truly the only source of truth.
Take a backup before production deploys that change tables.
Pin the package version (pip install pawabase-iac==X.Y.Z) so a release can’t surprise a deploy.
Keep .env out of git.

Plan and deploy

What deploy does.

Secrets and env

Keys and secrets.

Overview

Infrastructure as code

Define your backend

Logic and events

Files and mail

Ship it

Reference

SDK clients

CI/CD with GitHub Actions

Secrets and variables

Pull requests: validate and plan

Merge: deploy

Good practice

Plan and deploy

Secrets and env

​Secrets and variables

​Pull requests: validate and plan

​Merge: deploy

​Good practice

Plan and deploy

Secrets and env

Secrets and variables

Pull requests: validate and plan

Merge: deploy

Good practice