CI/CD Integration

Choose A Pattern

• Self-managed: each repository owns its own

  .github/infra.yaml

• Central management: one config repo manages many target repos

• Self-managed workflow: references/self-managed.md
• Central management workflow: references/central.md

Common Building Blocks

• gh infra apply ... --auto-approve

  on merge to

  main

• gh infra plan ... --ci

  on a schedule for drift detection
• use

  GITHUB_TOKEN

  only for self-managed single-repo workflows
• use a fine-grained PAT or GitHub App token for cross-repo central management

Authentication

Self-managed

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Central management

• a fine-grained PAT with the required per-repo permissions
• or a GitHub App installation token

env:
  GITHUB_TOKEN: ${{ secrets.GH_INFRA_TOKEN }}

Important Constraints

• gh-infra reads only top-level

  *.yaml

  /

  *.yml

  in the target directory
• if manifests are split across

  repos/

  and

  files/

  , run once per directory

• --auto-approve

  is required in CI

• --ci

  makes

  plan

  exit 1 when drift exists

Typical Flows

• PR review flow: run

  plan

  on pull requests touching manifests
• Auto-apply flow: run

  apply --auto-approve

  on merge
• Drift detection flow: run

  plan --ci

  on a schedule