settle-action

GitHub Action for running Setteld CLI operations in CI/CD pipelines.

Usage

Validate Fiatteringsmatrix rules on every PR

steps:
  - uses: actions/checkout@v4
  - uses: Setteld/settle-action@v1
    with:
      command: rules validate ./rules
      token: ${{ secrets.SETTELD_TOKEN }}
      environment: staging

Deploy rules to staging on merge to main

steps:
  - uses: actions/checkout@v4
  - uses: Setteld/settle-action@v1
    with:
      command: rules deploy ./rules --env staging
      token: ${{ secrets.SETTELD_TOKEN }}
      environment: staging

Production deploy with dual-control diff hash

steps:
  - uses: actions/checkout@v4

  # Step 1: compute diff hash (dry-run)
  - name: Compute rules diff hash
    uses: Setteld/settle-action@v1
    with:
      command: rules deploy ./rules --env production --dry-run
      token: ${{ secrets.SETTELD_TOKEN }}
      environment: production

  # Step 2: deploy with confirmed hash (requires RULES_DIFF_HASH set in GitHub vars)
  - name: Deploy rules to production
    uses: Setteld/settle-action@v1
    with:
      command: rules deploy ./rules --env production --confirm-diff-hash ${{ vars.RULES_DIFF_HASH }}
      token: ${{ secrets.SETTELD_TOKEN }}
      environment: production

Check disputes with SLA risk

steps:
  - uses: Setteld/settle-action@v1
    with:
      command: disputes list --sla-risk --output json
      token: ${{ secrets.SETTELD_TOKEN }}

Inputs

Input	Required	Default	Description
command	Yes	—	The setteld CLI command to run
token	Yes	—	Setteld API token (secrets.SETTELD_TOKEN)
environment	No	staging	Target environment: staging or production
version	No	latest	@setteld/cli npm version to install
working-directory	No	.	Working directory for the command

Outputs

Output	Description
result	Outcome of the command (success or failure)

Security

• Store your Setteld token as a GitHub Secret (SETTELD_TOKEN) — never hardcode it
• Production rule deploys require --confirm-diff-hash (dual-control gate — see setteld rules diff)
• All @setteld/cli releases are published with OIDC provenance (npm publish --provenance)
• Installing via curl | bash is a supply-chain attack vector — this Action uses only the npm registry

Versioning

Pin to a major version tag for stability:

uses: Setteld/settle-action@v1   # recommended — picks up patch releases
uses: Setteld/settle-action@v1.0.0  # pin to exact release

License

MIT