GitHub Actions

Use the QuollVault CLI in a job after producing the mobile artifact.

Prerequisites

Store QUOLLVAULT_TOKEN as a GitHub Actions secret. Store Project/App/Environment UUIDs as non-secret variables or workflow inputs.

- name: Upload build
  env:
    QUOLLVAULT_TOKEN: ${{ secrets.QUOLLVAULT_TOKEN }}
  run: |
    quollvault config set api https://api.quollvault.com
    quollvault config set app "${{ vars.QUOLLVAULT_APP_ID }}"
    quollvault config set environment "${{ vars.QUOLLVAULT_ENVIRONMENT_ID }}"
    quollvault upload ./build/app.apk

QuollVault detects GitHub Actions provenance from the job environment; do not manually copy bearer credentials into metadata.

Common failures

Use a scoped Automation Token, ensure the artifact exists before this step, and keep the token masked as a GitHub secret.

Related

• Upload
• Provenance