GitHub Actions · Tokenless CI
Connect the project, copy one workflow, verify one trusted push.
Skylos Cloud exchanges GitHub's short-lived OIDC identity for a repository-bound upload. No long-lived SKYLOS_TOKEN is stored in GitHub.
Sign-in returns to Projects. Choose the project for this repository, then open its settings and confirm the repository binding.
Save as
.github/workflows/skylos.yml
name: Skylos Tokenless CI
on:
push:
branches: [main]
permissions: {}
jobs:
skylos:
runs-on: ubuntu-latest
timeout-minutes: 15
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
persist-credentials: false
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.12"
- name: Install Skylos
run: python -m pip install "skylos>=4.7.0"
- name: Pull Skylos Cloud policy
run: skylos sync pull
- name: Scan and upload
run: skylos . --danger --quality --secrets --upload --forceThis workflow uploads only from trusted pushes to main.
Check these before the first upload
All four checks are required. If one is missing, use the recovery link on that check instead of debugging a generic authentication failure.
- 1
Skylos CLI 4.7.0 or newer
How to check
Run skylos --version in the job or locally before rollout.
If it is missing
Keep the version floor in the install step shown here; do not rely on an older cached CLI.
Review install step - 2
One Cloud project bound to this exact repository
How to check
Open the project and confirm its repository URL and monorepo subpath, if any.
If it is missing
Create or choose the project first. A repository path may belong to only one Cloud project.
Open Cloud project setup - 3
A trusted branch-push workflow
How to check
The upload job runs on push to your protected branch and grants id-token: write.
If it is missing
Do not upload with OIDC from pull_request jobs or untrusted fork code. Use a non-uploading scan there.
Review workflow trigger - 4
No SKYLOS_TOKEN in the tokenless job
How to check
Search the workflow's env and step configuration before calling the migration complete.
If it is missing
Keep the old secret only until one trusted OIDC upload succeeds, then remove it from the workflow and repository secrets.
See migration order
The complete setup path
1 · Project
Bind the repository
Use one Cloud project for the exact GitHub repository and monorepo subpath.
Open Projects2 · Workflow
Copy the YAML
Commit the workflow on a trusted branch. Keep
Copy workflow--forcewhile establishing the baseline.3 · Proof
Verify one push
Confirm the Action succeeds and the exact run appears in Cloud before removing the old secret or making the gate blocking.
Open project runs
Migrate without losing uploads
Existing token-based jobs continue to work. Add OIDC first, verify a trusted push, then remove SKYLOS_TOKEN. Remove --force only after the baseline is ready to block merges.
- 1. Commit id-token: write and the Skylos 4.7.0 version floor.
- 2. Push to the trusted branch and confirm the exact Cloud run.
- 3. Remove SKYLOS_TOKEN from workflow env and repository secrets.
- 4. Remove --force when your team intentionally enables a blocking gate.
Error → direct recovery
Security boundary
Tokenless uploads are repository-bound and accepted only from trusted branch-push identities. Pull requests and fork code should run non-uploading scans. Non-GitHub CI can continue using revocable project credentials.
Read the security model