{"id":31816841,"url":"https://github.com/splunk/acs-cicd-starter","last_synced_at":"2026-02-17T12:33:47.122Z","repository":{"id":218587442,"uuid":"682445267","full_name":"splunk/acs-cicd-starter","owner":"splunk","description":"CICD Starter for managing Splunk Cloud using ACS","archived":false,"fork":false,"pushed_at":"2023-12-11T17:19:01.000Z","size":86,"stargazers_count":9,"open_issues_count":0,"forks_count":6,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-10-11T09:58:56.149Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/splunk.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2023-08-24T07:23:20.000Z","updated_at":"2025-08-15T06:37:28.000Z","dependencies_parsed_at":"2024-01-22T23:14:40.497Z","dependency_job_id":"fe5de5dd-f716-407d-9999-5a025d19bf11","html_url":"https://github.com/splunk/acs-cicd-starter","commit_stats":null,"previous_names":["splunk/acs-cicd-starter"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/splunk/acs-cicd-starter","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/splunk%2Facs-cicd-starter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/splunk%2Facs-cicd-starter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/splunk%2Facs-cicd-starter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/splunk%2Facs-cicd-starter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/splunk","download_url":"https://codeload.github.com/splunk/acs-cicd-starter/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/splunk%2Facs-cicd-starter/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29543905,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-17T12:21:34.159Z","status":"ssl_error","status_checked_at":"2026-02-17T12:21:02.057Z","response_time":100,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-10-11T09:58:34.689Z","updated_at":"2026-02-17T12:33:42.075Z","avatar_url":"https://github.com/splunk.png","language":null,"readme":"# acs-cicd-starter\n\nThis is an example repository for using [ACS API](https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSIntro) in Github Actions to manage your Splunk Cloud environment. In addition to ACS API, Splunk also provides [ACS CLI](https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSCLI) and [ACS Terraform](https://registry.terraform.io/providers/splunk/scp/latest/docs) tools to manage your Splunk Cloud environment.\n\n**Disclaimer**:  When using this repo it will be # authorative for many tasks on your Splunk Cloud environment.  If this repo does not reflect the state of your environment when you wire it up then you may find unintended side effects such as changes to index settings, apps being removed, IP allow lists changing, etc.\n\n## Using this Repo\n\n- Clone the structure to your own repo or fork it\n- Enable Branch Protections to prevent direct commits to `main`\n- Create a feature branch\n- Make a change\n- Commit and push it\n- Create a pull request\n\n## Secrets\n\nFor the existing Github Action to work, we need 4 secured secrets in our pipelines. These are encrypted environment variables to allow management tasks to be performed.\n\nTo update/populate them in Github, see [Using secrets in GitHub Actions](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions)\n\n\n### STACK_NAME\n\nThis is the stack name that you wish to manage with your repo\n\nFor example, if you access your stack using `https://my-awesome-stack.splunkcloud.com`, the stack name will be `my-awesome-stack`.\n\n### STACK_TOKEN\n\nThis is the auth token that has been created within your Splunk Cloud stack so that you can authenticate and leverage ACS in your pipelines.\n\nTo create a new token, see [Create an authentication token guide](https://docs.splunk.com/Documentation/SplunkCloud/9.0.2209/Config/ACSusage#Create_an_authentication_token).\n\n### SPLUNKBASE_USERNAME\n\nWhen managing apps using ACS, we need Splunkbase credentials to generate a Splunkbase session ID. This is required for retrieving Splunkbase app information and inspecting private apps. We suggest creating a dedicated user for this.\n\n### SPLUNKBASE_PASSWORD\n\nThe Splunkbase password to go with the above username.\n\n## Splunkbase App management\n\nWhen using this repo, ACS will be authoratitive for managing Splunkbase apps. So if someone installs a Splunkbase app via the UI and it is not in the [splunkbaseApps.json](./splunkbaseApps.json) file here then it will be uninstalled when the deployment pipeline runs next.\n\n### App Installation\n\nWhen installing an app the latest version of the app will be used, you need to add the following code snippet to the file [splunkbaseApps.json](./splunkbaseApps.json)\n\n```json\n    {\n        \"appName\": \"SplunkforPaloAltoNetworks\",\n        \"splunkbaseID\": \"491\",\n        \"license\": \"http://opensource.org/licenses/ISC\"\n    }\n```\n\n**Note:**\n- Information about the app including the required license can be found at [splunkbase.splunk.com](https://splunkbase.splunk.com/).\n- If the `version` is not specified, ACS will install the latest available version for the app.\n\n### App Updates\n\nAdd the version parameter to your JSON and set to the version you wish to install\n\n```json\n    {\n        \"appName\": \"SplunkforPaloAltoNetworks\",\n        \"version\": \"7.0.4\",\n        \"splunkbaseID\": \"491\",\n        \"license\": \"http://opensource.org/licenses/ISC\"\n    }\n```\n\n**Note:**\n- If the version in your codebase is no longer available from Splunkbase then you may get an error in your pipeline until you update your [splunkbaseApps.json](./splunkbaseApps.json) to represent the present version available in Splunkbase.\n\n### App Removal\n\nRemove the section from the JSON on the app you wish to uninstall. When the pipeline runs it will check the installed Splunkbase apps and if it is not in [splunkbaseApps.json](./splunkbaseApps.json) then it will be removed.\n\n### Unmanaged Splunkbase Apps\n\nThere are Splunkbase apps that are installed by default in Splunk Cloud or that you might not want to be managed by this process, these can be added to an ignore list in [workflow_support/splunkbase_exclusion.json](./workflow_support/splunkbase_exclusion.json)\n\n## Private App Management\n\n**Limitations:**\n- This repo only supports private app installation on `Victoria` experience. However, see [instructions here](https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ManageApps#Manage_private_apps_using_the_ACS_API_on_Classic_Experience) for managing private apps using ACS API on `Classic` experience.\n- It doesn't currently support local folders, pipeline will fail if one is detected\n- Uninstallation of private apps via pipeline is not yet implemented\n\n### App Installation\n\nAdd private apps as files to the [privateApps](./privateApps/) folder in the repository, treat this folder as you would when working on an app in `$SPLUNK_HOME/etc/apps`, i.e. uncompressed. This will make it easier to work on individual files within the app.\n\nOnly apps that are different in the merge request to what is in main will have actions take to try and deploy.\n\nThe Pipeline process is:\n1. Identify apps that have changed and stash them\n2. Append the short git commit ID to version in app.conf\n3. Create tarball of the changed apps\n4. Run each app through appInspect, first failure will kill pipeline\n5. Upload any failure reports as artifacts to the pipeline for review\n6. If no failures are encountered attempt to install the apps\n\n## Scope for 0.1\n\n#### CI Steps ####\n\n- Validate HEC json\n- Validate IP Allow JSON\n- Validate indexes JSON\n- Private Apps (install and update)\n- splunkBase apps (install and delete working)\n\n#### CD Steps ####\n\n- no secrets no continue - validate connectivity and auth\n- IP Allow Deploy - what's changed\n- IP Allow Deploy - install new bits\n- IP Allow Deploy - Remove bits in Cloud that aren't in Git\n- indexes Deploy - install new\n- indexes Deploy - updated changed\n- hec Deploy - install new  **what to do with secrets**\n- hec Deploy - update changed **what to do with secrets**\n- private App - identify changed apps, update version to something relevant to commit/merge in changed apps, package changed apps, push changed apps\n- splunkBase apps - get current, workout delta, install new, upgrade existing, remove those not in code\n\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsplunk%2Facs-cicd-starter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsplunk%2Facs-cicd-starter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsplunk%2Facs-cicd-starter/lists"}