busbar-actions/Busbar — run CumulusCI under the nono sandbox
Run a CumulusCI flow/task against a Busbar-equipped Salesforce org with the OIDC-minted session injected proxy-side (cci never holds the token) and the process confined by nono (filesystem grants + ProxyOnly egress). Backed by the busbar-sandbox-run binary; self-mints via GitHub OIDC — the caller job MUST grant `permissions: id-token: write` and the org must have an active trust rule for this repository/workflow.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 4, 2026
- License
- None
Pinned Snippet
uses: busbar-actions/cci-run@27c44d0ead1aa5bf85b257508fa832fcf76d22d9 # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| target-instance | Instance URL of the Busbar-equipped org (e.g. https://my.my.salesforce.com). | yes | — |
| cci-args | CumulusCI arguments, e.g. `task run query --org dev -o object Organization -o query "SELECT Id, Name FROM Organization"` or `flow run dev_org --org dev`. | yes | — |
| org-name | cci org name to register via the EnvironmentProjectKeychain (matches --org in cci-args). | no | dev |
| cumulusci-version | pip version spec for CumulusCI (empty => latest). | no | "" |
| working-directory | CumulusCI project directory (must contain cumulusci.yml). | no | . |
| allow-hosts | Extra hosts the sandboxed child may reach over a plain CONNECT tunnel (comma-separated). The org host is always allowed. | no | pypi.org,files.pythonhosted.org |
| version | busbar-sandbox-run release tag to download ("latest" resolves the most recent). | no | latest |
| binary-repo | GitHub repo that publishes the busbar-sandbox-run binary releases. | no | busbar-actions/actions-dist |
| token-handler | OIDC token-exchange handler developer name in the org. Empty/default => busbar-auth's default (GitHubTokenExchangeHandler). | no | GitHubTokenExchangeHandler |
| eca-client-id | Optional ECA consumer-key override for the OIDC exchange (empty => busbar-auth default). | no | "" |
| keychain-package | pip install spec for the Busbar CumulusCI keychain (e.g. a path such as "$GITHUB_WORKSPACE/cumulusci" in the checked-out project, or a git URL). Empty => the keychain class must already be importable in the environment. | no | "" |
| keychain-class | Dotted path of the CumulusCI keychain class that provisions the org through the Busbar proxy. | no | busbar_cci_keychain.BusbarKeychain |
| audit-out | Path to write the observed-endpoint declaration (host+method+path+decision, distilled from the proxy audit stream). Empty => not written. | no | "" |
| allowlist | Path to an endpoint declaration (from a prior audit-out run) to ENFORCE: the org route becomes default-deny, allowing only the recorded endpoints (dynamic path segments generalized to `*`). Empty => no enforcement. | no | "" |
| expect-denial | Invert the exit code for NEGATIVE enforcement tests. When `true`, this action SUCCEEDS (exit 0) if the sandboxed cci command is DENIED (fails, e.g. by the `allowlist`) and FAILS if it unexpectedly succeeds — so the step does not surface a spurious "Process completed with exit code 1". | no | false |
| artifact-name | Name for the uploaded audit + generalized-fingerprint artifact. Must be UNIQUE within a workflow run — set a distinct value per cci-run step in a multi-step job (upload-artifact rejects duplicate names). | no | busbar-sandbox-cci |
Outputs
no outputs