GitHub Actions

Reading time: 0 minute(s) (0 words)

Use the Nobl9 sloctl action to validate definitions and apply or delete Nobl9 resources. For a custom workflow, run the sloctl Docker image directly. Both examples use the CI/CD management lifecycle.

Configure the workflow

1. Store active Nobl9 YAML definitions under slo-definitions/active/ in the repository. Set metadata.project in each project-scoped definition to select its target Project. Keep definitions queued for deletion under slo-definitions/to-delete/.
2. Create Nobl9 access keys with permission to manage those resources.
3. Add the client ID and client secret as GitHub Actions secrets. Name them NOBL9_CLIENT_ID and NOBL9_CLIENT_SECRET. These names identify GitHub secrets, not sloctl environment variables.
4. Choose one example below and save it as .github/workflows/nobl9.yaml.

Deletes queued resources

The delete step removes the Nobl9 resources defined in to-delete/. Review those definitions and their target Projects before you enable the workflow.

Nobl9 GitHub Action

This workflow uses the Nobl9 action to validate, apply, and delete resources after a push to main. It runs when either definition folder or the workflow file changes.

Choose your Nobl9 instance: app.nobl9.comus1.nobl9.com

.github/workflows/nobl9.yaml

name: Deploy Nobl9 resources

on:
  push:
    branches:
      - main
    paths:
      - "slo-definitions/active/**"
      - "slo-definitions/to-delete/**"
      - ".github/workflows/nobl9.yaml"

permissions:
  contents: read

concurrency:
  group: nobl9-deployment
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Check out definitions
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Validate active definitions
        if: ${{ hashFiles('slo-definitions/active/**/*.yaml') != '' }}
        uses: nobl9/nobl9-action@v0.3.0
        with:
          client_id: ${{ secrets.NOBL9_CLIENT_ID }}
          client_secret: ${{ secrets.NOBL9_CLIENT_SECRET }}
          sloctl_yml: "slo-definitions/active/**/*.yaml"
          operation: apply
          dry_run: "true"

      - name: Validate queued deletions
        if: ${{ hashFiles('slo-definitions/to-delete/**/*.yaml') != '' }}
        uses: nobl9/nobl9-action@v0.3.0
        with:
          client_id: ${{ secrets.NOBL9_CLIENT_ID }}
          client_secret: ${{ secrets.NOBL9_CLIENT_SECRET }}
          sloctl_yml: "slo-definitions/to-delete/**/*.yaml"
          operation: delete
          dry_run: "true"

      - name: Apply active definitions
        if: ${{ hashFiles('slo-definitions/active/**/*.yaml') != '' }}
        uses: nobl9/nobl9-action@v0.3.0
        with:
          client_id: ${{ secrets.NOBL9_CLIENT_ID }}
          client_secret: ${{ secrets.NOBL9_CLIENT_SECRET }}
          sloctl_yml: "slo-definitions/active/**/*.yaml"
          operation: apply

      - name: Delete retired resources
        if: ${{ hashFiles('slo-definitions/to-delete/**/*.yaml') != '' }}
        uses: nobl9/nobl9-action@v0.3.0
        with:
          client_id: ${{ secrets.NOBL9_CLIENT_ID }}
          client_secret: ${{ secrets.NOBL9_CLIENT_SECRET }}
          sloctl_yml: "slo-definitions/to-delete/**/*.yaml"
          operation: delete

The instance selector adds oktaOrgURL and oktaAuthServer to each action step for the US instance, us1.nobl9.com. For the EU instance, app.nobl9.com, the example uses the default authentication settings.

The workflow validates both folders with dry_run: "true" before it changes resources. It then applies active/ definitions with operation: apply and deletes to-delete/ resources with operation: delete. Keep the two folders separate so the apply step cannot recreate resources queued for deletion.

For supported inputs and usage details, see the Nobl9 action documentation.

The action packages its own sloctl version. Use the Docker example to select the CLI image version directly.

sloctl Docker image

This custom workflow runs nobl9/sloctl:latest directly through GitHub's Docker image steps. It runs after a push to main that changes either definition folder or the workflow file. Replace my-project in the commands with your target Project name.

Use the environment-variable method described in Docker authentication.

Choose your Nobl9 instance: app.nobl9.comus1.nobl9.com

.github/workflows/nobl9.yaml

name: Manage Nobl9 resources with sloctl

on:
  push:
    branches:
      - main
    paths:
      - "slo-definitions/active/**"
      - "slo-definitions/to-delete/**"
      - ".github/workflows/nobl9.yaml"

permissions:
  contents: read

concurrency:
  group: nobl9-deployment
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      SLOCTL_CLIENT_ID: ${{ secrets.NOBL9_CLIENT_ID }}
      SLOCTL_CLIENT_SECRET: ${{ secrets.NOBL9_CLIENT_SECRET }}
      SLOCTL_NO_CONFIG_FILE: "true"
    steps:
      - name: Check out definitions
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Validate active definitions
        if: ${{ hashFiles('slo-definitions/active/**/*.yaml') != '' }}
        uses: docker://nobl9/sloctl:latest
        with:
          args: >-
            apply --dry-run --yes
            --file "slo-definitions/active/**/*.yaml"
            --project my-project

      - name: Validate queued deletions
        if: ${{ hashFiles('slo-definitions/to-delete/**/*.yaml') != '' }}
        uses: docker://nobl9/sloctl:latest
        with:
          args: >-
            delete --dry-run --yes
            --file "slo-definitions/to-delete/**/*.yaml"
            --project my-project

      - name: Apply active definitions
        if: ${{ hashFiles('slo-definitions/active/**/*.yaml') != '' }}
        uses: docker://nobl9/sloctl:latest
        with:
          args: >-
            apply --yes
            --file "slo-definitions/active/**/*.yaml"
            --project my-project

      - name: Delete retired resources
        if: ${{ hashFiles('slo-definitions/to-delete/**/*.yaml') != '' }}
        uses: docker://nobl9/sloctl:latest
        with:
          args: >-
            delete --yes
            --file "slo-definitions/to-delete/**/*.yaml"
            --project my-project

      - name: Retrieve SLOs for verification
        uses: docker://nobl9/sloctl:latest
        with:
          args: get slos --project my-project

The workflow validates active definitions and queued deletions before it changes resources. It then applies active definitions, deletes retired resources, and retrieves the remaining SLOs. Review that output to confirm the expected state.

Both examples use hashFiles to skip commands whose input folders contain no YAML definitions. Validation sends requests to Nobl9 without persisting changes. If a step fails, GitHub skips later steps and marks the job as failed.

After deletion succeeds, remove completed deletion requests in a follow-up commit. Neither workflow changes or commits repository files.

Protect main with your repository's review requirements before you enable either workflow. For production deployments that need separate approval, use GitHub deployment environments. Do not expose Nobl9 credentials to workflows that execute untrusted pull request code.