dig-network/Deploy to DIG Network

Publish your build to the DIG Network on Chia — git-push-to-deploy. Installs the digstore CLI, runs `digstore deploy`, and reports the capsule + URLs + cost back on the PR.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
directory	The built-output directory to publish (your dist/ or build/).	no	dist
store-id	The 64-hex store id to advance. Optional — defaults to `store-id` in your dig.toml.	no	""
if-changed	Skip the deploy (and the $DIG + XCH spend) when the build is byte-identical to the live version. The no-op guard that lets you run this on every push.	no	true
preview	Force a PR-style preview even off the default branch. Wave-2 (#18) free, no-spend per-PR previews are NOT YET available — until that infra ships, `preview: true` would publish a REAL capsule on Chia (a $DIG spend) merely labelled "preview". To avoid a silent spend, this action FAILS CLOSED when `preview: true` is set unless you also set `allow-paid-preview: true`. PRs already preview automatically (event-derived, never blocked). Leave false for production deploys.	no	false
allow-paid-preview	Opt in to the paid `preview: true` path while free no-spend previews (#18) are unavailable. Required ONLY when you set `preview: true`; without it a forced preview fails closed rather than silently publishing a real ($DIG) capsule. Has no effect on the automatic event-based preview.	no	false
digstore-version	The digstore CLI version to install. A release tag (e.g. `v0.6.0`), a git ref/branch, or `latest`. PIN this for reproducible CI. The keyless writer deploy-key (`--writer-key`) and the free `deploy --preview` path (#17/#18) require digstore >= `v0.6.0`, which is the default.	no	v0.6.0
keyless	KEYLESS CI auth (#23): obtain a GitHub OIDC token (audience=dighub) and exchange it with the hub for a short-lived, store-scoped session — NO long-lived dighub secret in the repo. Requires `permissions: id-token: write`. The repo+ref must be bound to your store on hub.dig.net. On by default; set `false` only for the legacy secret-based path.	no	true
api-base	The dighub control-plane API base for the OIDC exchange. Defaults to the public hub.	no	https://hub.dig.net/v1
writer-key	The on-chain WRITER DELEGATE key (64-hex seed) that advances the store's root WITHOUT the owner master seed (#17). The owner pre-authorizes this writer (hub Teams "Deployer"); it can change ONLY the metadata root — never the owner, never melt. Pass from a repo secret. Maps to `digstore deploy --writer-key` / `DIGSTORE_WRITER_KEY`.	no	""
passphrase	The deploy wallet's DIGSTORE_PASSPHRASE — unlocks the seed that PAYS the on-chain fee ($DIG + XCH) for a real deploy to the default branch. NOT needed for PR previews (free, no chain). In keyless mode the writer-key advances the root and the OIDC session authorizes the push; this seed only funds the spend. Use a DEDICATED deploy wallet funded with only what your deploys need — never your main wallet. Pass from a repo SECRET only.	no	""
deploy-key	The store's §21 PUBLISHER deploy key (64-hex, from `digstore deploy-key export`). Authorizes publishing the capsule head to DIGHub; has NO on-chain spend authority. Distinct from `writer-key` (the on-chain root-advance authority). Pass from a repo secret. Maps to `digstore deploy --deploy-key` / `DIGSTORE_DEPLOY_KEY`.	no	""
mnemonic	The deploy wallet's BIP-39 mnemonic, imported under the passphrase before deploy. Pass from a repo secret. Has full spend authority — use a dedicated deploy wallet (see `passphrase`).	no	""
salt	Secret salt (64-hex) for a PRIVATE store. Omit for public stores. Pass from a repo secret.	no	""
remote	The remote to publish to (e.g. `dig://<store-id>` or a self-hosted node URL). Defaults to the public DIGHub.	no	""
message	Commit message for the new capsule. Defaults to the commit being deployed.	no	""
build-command	Optional shell command to build before deploying (e.g. `npm ci && npm run build`). Usually you build in a prior step instead.	no	""
wait-timeout	Seconds to wait for on-chain confirmation (0 = submit and don't block).	no	600
comment-on-pr	On a pull request, upsert a comment with the capsule, URLs and cost, and set a GitHub deployment + commit status.	no	true
github-token	Token used to comment on the PR and create the deployment/commit status. Defaults to the workflow's GITHUB_TOKEN.	no	${{ github.token }}
working-directory	Directory to run digstore from (where dig.toml lives). Defaults to the repo root.	no	.

Outputs

name	description
capsule	The published capsule: `storeId:rootHash`.
root	The new on-chain root hash.
store-id	The store id that was advanced.
chia-url	The chia:// content-open address of the deployment (rootless = latest tip) — the user-facing scheme the DIG Browser/extension register.
dig-url	DEPRECATED alias of `chia-url` (now also a chia:// content-open address). Use `chia-url`.
urn	The root-pinned URN permalink (urn:dig:chia:<store>:<root>).
hub-url	The DIGHub URL for the store (https://hub.dig.net/stores/<id>).
coin-id	The on-chain coin id of the anchored root.
content-address	On a `--preview` build: the shareable root-pinned chia:// content-open address of the preview capsule. Empty on a real deploy.
preview	`true` when this run produced a free preview build (PR), not a real on-chain deploy.
skipped	`true` when --if-changed skipped a no-op deploy.
spent	`true` when the deploy spent $DIG (a real publish).
pushed	`true` when the capsule was published to the hub.
json	The whole normalized deploy result as ONE JSON blob (incl. the `outcome`). Parse this once (`JSON.parse(steps.dig.outputs.json)`) instead of re-stitching the scalar outputs.
outcome	The catalogued result: one of success \| skipped \| preview \| dry-run \| anchor-failed \| push-failed \| timed-out \| no-credential \| unauthorized \| oidc-error \| blocked-paid-preview \| failed. Branch on this instead of scraping log lines. Written even on the failure path.
failure-reason	A human/machine reason string when `outcome` is a failure; empty otherwise.
environment	The resolved deploy environment: `preview` or `production` (from the event mode).
teardown	`true` when this run tore down a closed PR's preview (deactivated its GitHub Deployment(s) and updated the PR comment) instead of building — a closed `pull_request` event. `false` otherwise.