Skip to main content
ubx works well in CI/CD pipelines. This guide covers common patterns for GitHub Actions and GitLab CI.

GitHub Actions

Plan on Pull Request

name: ubx plan

on:
  pull_request:
    paths:
      - '**.iac'
      - 'ubx.yaml'

jobs:
  plan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.21'

      - name: Install ubx
        run: go install github.com/ubiquex/ubx@latest

      - name: Install Pulumi
        uses: pulumi/actions@v5

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-west-1

      - name: ubx validate
        run: ubx validate --compile

      - name: ubx plan
        run: ubx plan --env staging
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
          UBX_AI_API_KEY: ${{ secrets.UBX_AI_API_KEY }}

Apply on Merge to Main

name: ubx apply

on:
  push:
    branches: [main]
    paths:
      - '**.iac'
      - 'ubx.yaml'

jobs:
  apply:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install ubx
        run: go install github.com/ubiquex/ubx@latest
      - name: Apply
        run: ubx apply --yes --env prod
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

CI Flags

CommandCI-safe variant
ubx applyubx apply --yes
ubx destroyubx destroy --force
ubx upgradeubx upgrade --check
ubx reviewubx review --min-severity high
ubx fmtubx fmt --check

Non-Interactive Detection

ubx automatically detects non-interactive environments (piped stdin, CI env vars) and skips confirmation prompts. --yes is an explicit override.

Version Constraints

Pin the minimum ubx version in ubx.yaml to prevent CI surprises:
ubx_version: ">= 1.0.0"