GitHub Actions
Use the QuollVault CLI in a job after producing the mobile artifact.
Prerequisites
Store QUOLLVAULT_TOKEN as a GitHub Actions secret. Store App/Environment UUIDs and Android build identity as non-secret variables or workflow inputs.
yaml
- name: Upload build
env:
QUOLLVAULT_TOKEN: ${{ secrets.QUOLLVAULT_TOKEN }}
run: |
npm install --global quollvault-cli
quollvault config set api https://api.quollvault.com
quollvault config set app "${{ vars.QUOLLVAULT_APP_ID }}"
quollvault config set environment "${{ vars.QUOLLVAULT_ENVIRONMENT_ID }}"
quollvault upload ./build/app.apk --app-identifier "${{ vars.QUOLLVAULT_APP_IDENTIFIER }}" --version "${{ vars.QUOLLVAULT_VERSION }}" --build-number "${{ vars.QUOLLVAULT_BUILD_NUMBER }}"QuollVault detects GitHub Actions provenance from the job environment; do not manually copy bearer credentials into metadata.
Prompt an agent to add GitHub Actions upload
text
Add a QuollVault upload step to this repository's GitHub Actions mobile-build workflow.
Inspect the existing workflows and build scripts before editing. Add the upload after the selected Android or iOS artifact is produced and available to the job. Install `quollvault-cli`, set the API origin plus App and Environment UUIDs, and run `quollvault upload` against the real artifact path. Map `QUOLLVAULT_TOKEN` only from a GitHub Actions secret. Use repository variables or inputs for non-secret App/Environment IDs and, for Android, application identifier, version and build number. Preserve existing workflow behavior and rely on GitHub Actions environment data for provenance rather than manually supplying it.
Before editing, ask me which workflow and job to change if more than one can produce the artifact. Ask which artifact, QuollVault App/Environment and non-secret identity-variable source to use whenever the repository does not make them clear. If the secret is not already configured, explain the exact secret name and ask me to add it; do not request or reveal its value.
Validate the YAML and summarize the secret, variables and artifact path that must be configured. Do not commit credentials.Common failures
Use a scoped Automation Token, ensure the artifact exists before this step, and keep the token masked as a GitHub secret.