CI workflow
What each piece of the Greenroom workflow does, and which parts not to change.
The quickstarts give complete workflows for web and iOS. This page explains the load-bearing pieces so you can adapt the rest to your project with confidence.
The two-job split (iOS)
The build job runs your project's own toolchain: dependency install, pods, xcodebuild. Project toolchains execute arbitrary project code, so this job carries no secrets and no Greenroom identity; its only output is the simulator .app uploaded as an artifact.
The greenroom job never runs your build system. It downloads the artifact, materializes policy, and invokes the Greenroom action with an OIDC token (id-token: write) as its only credential. Web apps that can build and serve a static preview without secrets can use a single job, as the web quickstart does.
Policy from the base revision
- name: Materialize Greenroom policy from the trusted base revision
env:
GREENROOM_BASE_SHA: ${{ github.event.pull_request.base.sha }}
run: |
git show "${GREENROOM_BASE_SHA}:.greenroom/environment.json" > "${RUNNER_TEMP}/greenroom-environment.json"
git show "${GREENROOM_BASE_SHA}:.greenroom/state-contract.json" > "${RUNNER_TEMP}/greenroom-state-contract.json"Both config files are read from the PR's base commit. A PR that edits .greenroom/ files still runs under the old policy; the new policy takes effect once the PR merges. This is what prevents a malicious or careless PR from allowlisting a production host or deleting the oracle that would catch its bug. Keep this step exactly as written.
Action inputs
| Input | Meaning |
|---|---|
greenroom-api-url | The Greenroom control plane, https://app.getgreenroom.io. |
platform | web or ios. Determines which networkControl values the manifest may declare. |
target-url (web) | The preview URL to walk. |
artifact, app, device (iOS) | Path to the simulator .app, its bundle id, and the simulator device name to create. |
environment-manifest, state-contract | The policy files materialized from the base revision. Point these at ${{ runner.temp }}, never at the checkout. |
base-sha, head-sha | The diff to scope. Pass the event values as shown. |
workflow-ref, workflow-sha | Bound into the OIDC exchange so the run is attributable to this exact workflow revision. |
pull-request-number | Where the handoff is posted. |
source-upload-allowed | Off by default. Enables uploading the graph source files a declared routerKind needs. Turn it on only after repository and workspace policy have both been reviewed. |
Hygiene the examples bake in
- Every action is pinned to a full commit SHA, with the version as a comment. Pin the Greenroom action the same way once you have reviewed a release.
persist-credentials: falseon every checkout keeps the repo token out of subsequent steps.permissionsblocks are minimal:contents: readeverywhere,id-token: writeonly on the greenroom job.- Timeouts on both jobs keep a wedged simulator from consuming your CI quota.