Skip to content

CI/CD Integration

Use the same blueprint that developers use locally to provision build environments in CI. alloy-provisioner runs on any Linux runner (PC, laptop, or server, VM, or Docker) and installs the exact toolchain and dependencies from your blueprint.

Options

Approach When to use Doc
Native on Linux runner Runner is already Linux (e.g. GitHub-hosted ubuntu-latest, self-hosted Linux agent). Install alloy-provisioner, then run alloy-provisioner install <blueprint>. On Linux (Native)
Docker image You want a pre-baked image with the environment, or your pipeline uses Docker. Build an image that runs alloy-provisioner during the Docker build. In a Docker Image

Both can use the same blueprint definition so CI and local dev stay aligned. Commit an alloy.lock.yml in your repo when you use catalog toolchain refs; there is no separate public “resolve in CI” flow for git-only blueprints yet—see Catalog.

Quick example (GitHub Actions, native)

Runner is Ubuntu; install the provisioner, provision with a tagged blueprint, then build in a login shell (release 1.4.0 loads the toolchain via /etc/profile.d, not /etc/alloy/env):

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install alloy-provisioner
        run: |
          curl -fsSL https://raw.githubusercontent.com/alloy-it/alloy-provisioner-releases/main/scripts/install.sh | bash

      - name: Provision environment
        run: sudo alloy-provisioner install community/nordic/nrf91:1.1.3

      - name: Build
        shell: bash -l {0}
        run: make build

Provision inside a job container (not the host) needs --docker on 1.4.0:

      - name: Provision environment
        run: sudo alloy-provisioner install --docker community/nordic/nrf91:1.1.3

New in Alloy Host 2.2.0 / alloy-provisioner 1.5.0

Container and WSL detection will enable --docker / --wsl2 automatically. After install, CI can use source /etc/alloy/env in non-login steps instead of bash -l.

Pin the provisioner in the install step:

curl -fsSL https://raw.githubusercontent.com/alloy-it/alloy-provisioner-releases/main/scripts/install.sh | bash -s -- 1.4.0

Private blueprints and secrets

For organization or private blueprints, configure registry auth using secrets (e.g. GitHub Actions secrets, GitLab CI variables). Short names like myorg/my-blueprint:1.0.0 are resolved under the community project unless you use the full registry path—set credentials before sudo:

export ALLOY_REGISTRY_USERNAME="$REGISTRY_USER"
export ALLOY_REGISTRY_PASSWORD="$REGISTRY_TOKEN"
sudo -E alloy-provisioner install community/myorg/my-blueprint:1.0.0

Use ALLOY_URL or --registry for a custom registry host (scheme https:// is required for credentials to be sent correctly).

Never commit credentials; use your CI system’s secret storage.

More