chesapeakedev/dn-action

A GitHub Action that installs the dn CLI from GitHub Releases and can execute canonical dn workflows.

Usage

jobs:
  kickstart:
    runs-on: ubuntu-latest
    steps:
      - name: Run dn kickstart
        uses: chesapeakedev/dn-action@v1
        with:
          workflow: dn.kickstart_issue
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

With version pinning

Pin to a specific release to avoid unexpected updates:

      - uses: chesapeakedev/dn-action@v1
        with:
          version: "1.2.3"

Or use a semver range:

      - uses: chesapeakedev/dn-action@v1
        with:
          version: ">=1.2.0"

Custom install directory

      - uses: chesapeakedev/dn-action@v1
        with:
          version: "latest"
          install-dir: "$HOME/bin"

Inputs

Input	Default	Description
version	"latest"	Release tag or semver range to install
install-dir	"~/.local/bin"	Directory to install the binary into
github-token	workflow token	Optional override; defaults to github.token (see below)
workflow	""	Canonical workflow ID to execute; empty installs dn only
validate-only	"false"	Validate the event and configuration without executing

When workflow is set, the action checks out the caller repository, installs the configured agent harness, validates the GitHub event, and executes the mapped dn command. It writes validation and execution results to the workflow run summary. Validation failures remain failing action results. Before dn runs, the action configures the checkout's Git identity from github.actor so workflows that publish changes can create commits without additional setup.

Authentication

You do not need to set github-token or add an earlier step for a public chesapeakedev/dn release. The action uses the workflow’s built-in GITHUB_TOKEN automatically.

The github-token input is optional. Use it only when you need a different credential (for example a PAT that can read a private dn repo in another org).

For private release repos, ensure the job can read repository contents:

permissions:
  contents: read

If the default GITHUB_TOKEN cannot access the release repo (common across orgs), pass a PAT:

      - uses: chesapeakedev/dn-action@v1
        with:
          github-token: ${{ secrets.DN_RELEASES_TOKEN }}

Outputs

Output	Description
dn-version	Version tag of the installed dn
dn-path	Absolute path to the installed dn binary (dn or dn.exe)
status	Workflow result: passed, failed, or validated
phase	Last phase reached: validation, agent installation, or execution
workflow	Canonical workflow ID
commit-sha	Git commit SHA when dn published changes
branch-name	Branch name when dn published changes
pr-url	Pull request URL when dn opened a PR
publish-mode	Publish mode used by dn: none, pr, or direct

To verify a workflow without installing an agent or running the mapped command:

- uses: chesapeakedev/dn-action@v1
  with:
    workflow: dn.kickstart_issue
    validate-only: "true"

Platforms

The action auto-detects runner.os and runner.arch, downloads the matching release asset, and installs it as dn (or dn.exe on Windows) in the install directory:

OS	Arch	Release asset	Installed as
Linux	x64	dn-linux-x64	dn
Linux	ARM64	dn-linux-arm64	dn
macOS	x64	dn-macos-x64	dn
macOS	ARM64	dn-macos-arm64	dn
Windows	x64	dn-windows-x64.exe	dn.exe

Subsequent workflow steps can run dn directly once the install directory is on PATH (the action appends it via GITHUB_PATH).

Repository development

The repository includes opencode.json, which configures OpenCode to use the moonshotai/Kimi-K2.7-Code model through DeepInfra. Set DEEPINFRA_API_KEY in the development environment before using that provider.

Publish skill

The repository-local publish skill provides the controlled release workflow for this action. It is intended for an agent working in this repository after a user explicitly asks to publish or release approved changes.

The skill reviews the complete pending change, runs validation appropriate to the changed files, commits with Sapling when necessary, and pushes main without force. It then moves the public v1 tag to the exact commit on remote main and verifies that both remote references resolve to the same commit.

Moving v1 immediately updates workflows that use chesapeakedev/dn-action@v1. The skill therefore force-updates only the moving refs/tags/v1 reference and never force-pushes main.

Unsupported platforms

For platforms not listed above, install from source with deno compile:

      - uses: denoland/setup-deno@v1
        with:
          deno-version: ">=2.6.3"

      - name: Install dn from source
        run: |
          deno compile --allow-all -o dn https://esm.sh/chesapeake/dn/cli/main.ts
          echo "$PWD" >> $GITHUB_PATH