accentiostudios/Statio Deploy
Deploy a signed image to your own server over Tailscale. No SSH, no public port.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 14, 2026
- License
- None
Pinned Snippet
uses: accentiostudios/statio@a34135b088160393c52e9386116583c1db307eb2 # v0.2.6tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| target | Agent MagicDNS host (e.g. statio.tailnet.ts.net). Also the signed audience. | yes | — |
| service | Service slot name (must be accepted on the agent) | yes | — |
| image | Your app's image repository (e.g. ghcr.io/org/api) | yes | — |
| digest | Image digest (sha256:...). Leave it empty and the action builds and pushes the image. | no | "" |
| dockerfile | Dockerfile path, when the action builds the image | no | Dockerfile |
| context | Docker build context, when the action builds the image | no | . |
| image-tag | Tag to push the built image under (the deployed reference is always the digest) | no | ${{ github.sha }} |
| sign | cosign-sign the image with the run's keyless identity. Set it to false when you sign the image yourself. | no | true |
| registry-username | Registry login user when the action pushes (defaults to the GitHub actor, for GHCR) | no | "" |
| registry-password | Registry login token when the action pushes (defaults to GITHUB_TOKEN, for GHCR; needs packages: write) | no | "" |
| statio-file | Path to the repo's statio.yaml (services + proxy + dns) | no | statio.yaml |
| env | Per-deploy env values, one KEY=VALUE per line. Source them from repo or org secrets so GitHub masks them. | no | "" |
| ts-oauth-client-id | Tailscale OAuth client id for CI (a tag:ci client, scope auth_keys). Store as a GitHub secret. | yes | — |
| ts-oauth-secret | Tailscale OAuth client secret for CI (the tag:ci client). Store as a GitHub secret. | yes | — |
| statio-version | Version of the statio binary to download (a bare major like v1, or an exact vX.Y.Z, or latest) | no | v1 |
| timeout | Deploy timeout (e.g. 5m) | no | 5m |
| strict | Treat success_degraded as failure | no | false |
| preflight | Run a read-only readiness check (host port, reverse proxy, DNS) before deploying. It changes nothing and stops the job on a misconfiguration. | no | true |
Outputs
no outputs