Flagsmith/setup-cli

Install the Flagsmith CLI in a GitHub Actions job, and authenticate it without storing a secret.

Usage

jobs:
  flagsmith:
    runs-on: ubuntu-latest
    permissions:
      id-token: write # required for the token exchange
      contents: read
    steps:
      - uses: Flagsmith/setup-cli@v1
      - run: flagsmith auth status

Or, with a static key:

jobs:
  flagsmith:
    runs-on: ubuntu-latest
    env:
      FLAGSMITH_API_KEY: ${{ secrets.FLAGSMITH_API_KEY }}
    steps:
      # Installs the CLI and skips the token exchange:
      - uses: Flagsmith/setup-cli@v1
      - run: flagsmith flags list # uses your key

Inputs

Input	Default	Description
api-url	https://api.flagsmith.com	Flagsmith API base URL. Set this for self-hosted instances.
audience	https://github.com/OWNER	The aud claim to request. Only set this if your Flagsmith trust relationship uses a custom audience.
cli-version	latest	CLI version to install, e.g. v2.0.0.

When the action skips authentication

The action always installs the CLI, but may skip authentication if:

• the run is a pull request from a fork.
• the job has no id-token: write permission.
• the job already carries a credential the CLI would use for this api-url (FLAGSMITH_API_KEY or FLAGSMITH_ACCESS_TOKEN, scoped to provided api-url).

After the action runs

The API URL and the exchanged access token are exported to the job environment, where the CLI picks them up.

The CLI binary is added to PATH via GITHUB_PATH, and cached in the runner tool cache by version and architecture.

Development

npm ci
npm test        # unit tests
npm run all     # typecheck, test, and rebuild dist/