GitHub Actions

The composite action auto-detects repository, commit, branch, actor, run URL, and pull request number from the GitHub environment, so there is little to configure.

Setup

1. Create an ingest token under Administration → Ingest tokens (/admin/ingest-tokens). The raw value is shown once — copy it then.
2. Store it as a repository or organization secret, for example CRITIAS_INGEST_TOKEN.
3. Add the action after your plan step.

Workflow

- run: terraform plan -out=tfplan
- run: terraform show -json tfplan > tfplan.json
- uses: athena-com/critias/integrations/github-action@v1
  with:
    api_url: https://api.example.com
    token: ${{ secrets.CRITIAS_INGEST_TOKEN }}
    plan_file: tfplan.json
    environment: prod # optional
    project_path: infra # optional (default ".")

The action needs terraform show -json output, not the binary plan file. That conversion is the terraform show line above.

Inputs

Input	Required	Description
api_url	yes	Your Aletheia API base URL
token	yes	The ingest token, from a secret
plan_file	yes	Path to the JSON plan produced by terraform show -json
environment	no	Environment name to associate the plan with
project_path	no	Path of the Terraform root within the repository. Defaults to .

Applies as well as plans

To record what actually ran, call the action again after terraform apply with the apply’s outcome. The execution and the plan are correlated, so Aletheia can show what was intended alongside what happened.

Requirements

• bash, curl, and jq on the runner. The standard GitHub-hosted runners have all three.
• Network egress from the runner to your Aletheia API URL.

Where to go next

• Ingest tokens for token scoping and rotation.
• Any CI if you also run Terraform outside GitHub Actions.