accentiostudios/Statio Deploy

Deploy a signed image to your own server over Tailscale — no SSH, no public port.

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Activelast commit Jul 14, 2026
License
None

Pinned Snippet

workflow.ymlSHA-pinned
uses: accentiostudios/statio@a34135b088160393c52e9386116583c1db307eb2 # v0.2.6

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
targetAgent MagicDNS host (e.g. statio.tailnet.ts.net). Also the signed audience.yes
serviceService slot name (must be accepted on the agent)yes
imageYour app's image repository (e.g. ghcr.io/org/api)yes
digestImage digest (sha256:...). Leave empty to let the action build & push the image for you.no""
dockerfileDockerfile path, when the action builds the imagenoDockerfile
contextDocker build context, when the action builds the imageno.
image-tagTag to push the built image under (the deployed reference is always the digest)no${{ github.sha }}
signcosign-sign the image with the run's keyless identity. Disable only if you already sign it yourself.notrue
registry-usernameRegistry login user when the action pushes (defaults to the GitHub actor, for GHCR)no""
registry-passwordRegistry login token when the action pushes (defaults to GITHUB_TOKEN, for GHCR; needs packages: write)no""
statio-filePath to the repo's statio.yaml (services + proxy + dns)nostatio.yaml
envPer-deploy env overrides as KEY=VALUE lines (source values from your repo/org secrets so GitHub masks them)no""
ts-oauth-client-idTailscale OAuth client id for CI (a tag:ci client, scope auth_keys). Store as a GitHub secret.yes
ts-oauth-secretTailscale OAuth client secret for CI (the tag:ci client). Store as a GitHub secret.yes
statio-versionVersion of the statio binary to download (a bare major like v1, or an exact vX.Y.Z, or latest)nov1
timeoutDeploy timeout (e.g. 5m)no5m
strictTreat success_degraded as failurenofalse
preflightRun a read-only preflight check (port + reverse-proxy/DNS readiness) before deploying. Fails fast on a misconfiguration without changing anything on the server.notrue

no outputs