Documentation
Actions
Discover workflows, understand provider compatibility, inspect runs, and protect merges.
Actions is Upstream's provider-neutral workflow surface. Workflow files stay in the repository; an execution provider runs them; Upstream owns the workflow registry, run history, jobs, checks, and merge gating.
Workflow files
Place workflows under .github/workflows/*.yml or .yaml. Upstream discovers the files at the repository ref and reads common GitHub Actions fields including names, triggers, jobs, dependencies, runner labels, and declared manual inputs.
Provider modes
| Mode | Availability | How it works |
|---|---|---|
| GitHub Actions | Available | GitHub executes workflows for repositories with GitHub Sync or an active mirror. Upstream imports run and job status. |
| Native | Early access | Upstream manages execution through its native provider connection. Dispatches are signed and durable; results return to the canonical run and check ledger. |
| BYOP | Planned | Bring your own provider or self-hosted execution while keeping Upstream's workflow, run, and check model. The public provider contract is not available yet. |
A repository selects one active mode. The Actions page shows that mode and its real connection state. Native is the name of the managed Upstream path, not a generic label for every non-GitHub provider.
Compatibility
Each workflow is marked supported, supported with warnings, unsupported, or unknown for the selected provider. Unsupported runner platforms and workflow features are shown before cutover.
Do not assume every Marketplace Action is forge-independent. Some actions call GitHub APIs for releases, checks, packages, pull requests, or security uploads.
Runs and jobs
Runs record the workflow revision, trigger, ref, commit, actor, provider, attempt, jobs, duration, conclusion, and provider-hosted log links. Retry creates another attempt without losing history.
Secrets
Maintainers manage repository CI secrets from Actions settings. Values are encrypted at rest, shown only when created or rotated, and never included in the generic dispatch envelope.
Merge protection
Actions seeds a pending check when a workflow is triggered for a Change Request version. The same check advances as the provider reports status, so required checks protect the entire run window.