{"id":21802647,"url":"https://github.com/yc-actions/yc-sls-container-deploy","last_synced_at":"2025-08-20T18:33:19.631Z","repository":{"id":37430667,"uuid":"422331754","full_name":"yc-actions/yc-sls-container-deploy","owner":"yc-actions","description":"GitHub Action to deploy Serverless Container to Yandex Cloud","archived":false,"fork":false,"pushed_at":"2024-12-16T20:57:10.000Z","size":29980,"stargazers_count":29,"open_issues_count":2,"forks_count":8,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-12-16T21:50:00.408Z","etag":null,"topics":["docker","github-actions","serverless","serverless-containers","yandex-cloud"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/yc-actions.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-10-28T19:31:12.000Z","updated_at":"2024-12-16T20:56:00.000Z","dependencies_parsed_at":"2023-12-05T11:46:08.914Z","dependency_job_id":"09b72c59-cd70-4ac6-80db-1a2cc40e1cdd","html_url":"https://github.com/yc-actions/yc-sls-container-deploy","commit_stats":{"total_commits":313,"total_committers":4,"mean_commits":78.25,"dds":0.03833865814696491,"last_synced_commit":"6717f2b7761422445e1c6b0c3d95c61d9ffbf1d4"},"previous_names":[],"tags_count":12,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yc-actions%2Fyc-sls-container-deploy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yc-actions%2Fyc-sls-container-deploy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yc-actions%2Fyc-sls-container-deploy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yc-actions%2Fyc-sls-container-deploy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/yc-actions","download_url":"https://codeload.github.com/yc-actions/yc-sls-container-deploy/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":230445926,"owners_count":18227060,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","github-actions","serverless","serverless-containers","yandex-cloud"],"created_at":"2024-11-27T11:30:01.489Z","updated_at":"2025-08-20T18:33:19.604Z","avatar_url":"https://github.com/yc-actions.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"## GitHub Action to deploy Serverless Container to Yandex Cloud\n\nCreate a serverless container with the provided name if there is no one. Then deploy a new revision using the provided\nimage name and tag.\n\n**Table of Contents**\n\n\u003c!-- toc --\u003e\n\n- [Usage](#usage)\n- [Secrets](#secrets)\n- [Permissions](#permissions)\n- [License Summary](#license-summary)\n\n\u003c!-- tocstop --\u003e\n\n## Usage\n\n```yaml\n    - uses: actions/checkout@v4\n    \n    - name: Get Yandex Cloud IAM token\n      id: get-iam-token\n      uses: docker://ghcr.io/yc-actions/yc-iam-token-fed:1.0.0\n      with:\n        yc-sa-id: aje***\n\n    - name: Login to Docker Hub\n      uses: docker/login-action@v3\n      with:\n        registry: cr.yandex\n        username: iam\n        password: ${{ steps.get-iam-token.outputs.token }}\n\n    - name: Build, tag, and push image to Yandex Cloud Container Registry\n      env:\n        CR_REGISTRY: crp00000000000000000\n        CR_REPOSITORY: my-cr-repo\n        IMAGE_TAG: ${{ github.sha }}\n      run: |\n        docker build -t cr.yandex/$CR_REGISTRY/$CR_REPOSITORY:$IMAGE_TAG .\n        docker push cr.yandex/$CR_REGISTRY/$CR_REPOSITORY:$IMAGE_TAG\n\n    - name: Deploy Serverless Container\n      id: deploy-sls-container\n      uses: yc-actions/yc-sls-container-deploy@v4\n      with:\n        yc-sa-id: aje***\n        container-name: yc-action-demo\n        folder-id: bbajn5q2d74c********\n        revision-service-account-id: ajeqnasj95o7********\n        revision-cores: 1\n        revision-memory: 512Mb\n        revision-core-fraction: 100\n        revision-concurrency: 8\n        revision-image-url: cr.yandex/crp00000000000000000/my-cr-repo:${{ github.sha }}\n        revision-execution-timeout: 10\n```\n\nOne of `yc-sa-json-credentials`, `yc-iam-token` or `yc-sa-id` should be provided depending on the authentication method you\nwant to use. The action will use the first one it finds.\n* `yc-sa-json-credentials` should contain JSON with authorized key for Service Account. More info\n  in [Yandex Cloud IAM documentation](https://yandex.cloud/en/docs/iam/operations/authentication/manage-authorized-keys#cli_1).\n* `yc-iam-token` should contain IAM token. It can be obtained using `yc iam create-token` command or using\n  [yc-actions/yc-iam-token-fed](https://github.com/yc-actions/yc-iam-token-fed)\n```yaml\n      - name: Get Yandex Cloud IAM token\n        id: get-iam-token\n        uses: docker://ghcr.io/yc-actions/yc-iam-token-fed:1.0.0\n        with:\n          yc-sa-id: aje***\n```\n* `yc-sa-id` should contain Service Account ID. It can be obtained using `yc iam service-accounts list` command. It is\n  used to exchange GitHub token for IAM token using Workload Identity Federation. More info in [Yandex Cloud IAM documentation](https://yandex.cloud/ru/docs/iam/concepts/workload-identity).\n\n\nSee [action.yml](action.yml) for the full documentation for this action's inputs and outputs.\n\n## Secrets\n\nThe action supports Yandex Cloud Lockbox secrets integration. You can specify secrets using the `revision-secrets` input parameter.\n\n### Secret Format\n\nSecrets should be specified in the following format:\n```\nenvironmentVariable=secretId/versionId/key\n```\n\nWhere:\n- `environmentVariable` - the name of the environment variable that will be available in the container\n- `secretId` - the ID of the Lockbox secret\n- `versionId` - the version ID of the secret (use `latest` to automatically resolve to the current version)\n- `key` - the key within the secret payload\n\n**Note**: Lines starting with `#` are treated as comments and will be ignored. You can also add inline comments after the secret definition using `#`.\n\n### Usage Examples\n\n#### Basic Secret Usage\n```yaml\n    - name: Deploy Serverless Container\n      uses: yc-actions/yc-sls-container-deploy@v4\n      with:\n        # ... other parameters ...\n        revision-secrets: |\n          DATABASE_URL=secret123/version1/DATABASE_URL\n          API_KEY=secret456/latest/API_KEY\n```\n\n#### Multiple Secrets with Different Versions\n```yaml\n    - name: Deploy Serverless Container\n      uses: yc-actions/yc-sls-container-deploy@v4\n      with:\n        # ... other parameters ...\n        revision-secrets: |\n          DATABASE_URL_LATEST=secret123/latest/DATABASE_URL\n          DATABASE_URL_STABLE=secret123/version2/DATABASE_URL\n          API_KEY_LATEST=secret456/latest/API_KEY\n          API_KEY_STABLE=secret456/version5/API_KEY\n```\n\n#### Same Key with Different Environment Variables\nYou can use the same secret key with different versions and map them to different environment variables:\n\n```yaml\n    - name: Deploy Serverless Container\n      uses: yc-actions/yc-sls-container-deploy@v4\n      with:\n        # ... other parameters ...\n        revision-secrets: |\n          # Latest version for development\n          DATABASE_URL_DEV=secret123/latest/DATABASE_URL\n          # Stable version for production\n          DATABASE_URL_PROD=secret123/version2/DATABASE_URL\n          # Latest API key\n          API_KEY_LATEST=secret456/latest/API_KEY\n          # Specific version API key\n          API_KEY_STABLE=secret456/version5/API_KEY\n```\n\n#### Using Comments\nYou can add comments to document your secrets:\n\n```yaml\n    - name: Deploy Serverless Container\n      uses: yc-actions/yc-sls-container-deploy@v4\n      with:\n        # ... other parameters ...\n        revision-secrets: |\n          # Database configuration\n          DATABASE_URL=secret123/latest/DATABASE_URL # Latest database URL\n          API_KEY=secret456/version2/API_KEY  # Stable API key\n          \n          # Redis connection\n          REDIS_URL=secret789/latest/REDIS_URL # Redis connection string\n          \n          # JWT configuration\n          JWT_SECRET=secret999/version5/JWT_SECRET  # JWT signing key\n```\n\n### Latest Version Resolution\n\nWhen you specify `latest` as the version ID, the action will automatically resolve it to the current version of the secret by querying the Lockbox API. This ensures you always get the most up-to-date version without manually updating version IDs.\n\n### Concurrency Control\n\nThe action uses concurrency limiting (5 concurrent requests) when resolving \"latest\" versions to avoid overwhelming the Lockbox API.\n\n## Permissions\n\n### Deploy time permissions\n\nTo perform this action, the service account on behalf of which we are acting must have\nthe `serverless-containers.editor` role or higher.\n\nAdditionally, you may need to grant the following optional roles depending on your specific needs:\n\n| Optional Role                 | Required For                                                                           |\n|-------------------------------|----------------------------------------------------------------------------------------|\n| `iam.serviceAccounts.user`    | Providing the service account ID in parameters, ensuring access to the service account |\n| `vpc.user`                    | Deploying the container in a VPC with a specified network ID                           |\n| `serverless-containers.admin` | Making the container public                                                            |\n| `functions.editor`            | If you are using **secrets**. `serverless-containers.editor` missing some permissions, so you have to use this one additionnaly. |\n| `lockbox.payloadViewer`       | To access Lockbox secrets during deployment. Required for secret resolution.           |\n\n### Runtime permissions\n\nThe service account provided to container via `revision-service-account-id` parameter must have the following roles:\n\n| Required Role                 | Required For                                                        |\n|-------------------------------|---------------------------------------------------------------------|\n| `storage.viewer`              | To mount the bucket to the container in read only mode.             |\n| `storage.editor`              | To mount the bucket to the container in read-write mode.            |\n| `lockbox.payloadViewer`       | To access the Lockbox secrets.                                      |\n| `kms.keys.encrypterDecrypter` | To decrypt the Lockbox secrets, if they are encrypted with KMS key. |\n\n## License Summary\n\nThis code is made available under the MIT license.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyc-actions%2Fyc-sls-container-deploy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fyc-actions%2Fyc-sls-container-deploy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyc-actions%2Fyc-sls-container-deploy/lists"}