Use Ravenstash in CI/CD

CI jobs run the same rvs commands as developers. The automation token signs in the CLI; rvs selects the repository and keeps native package credentials out of project configuration.

Choose the token owner

Choose a token targeting the account that owns the package repository:

• Use a personal token only for personal repositories and personal automation.
• Use an organization token for shared builds and releases targeting organization repositories.

An organization-account PAT can act within a member’s current access, but shared CI should use an organization-owned automation token. Select only the required namespaces or repositories and Read or Publish access.

Store the secret

Save the token as a masked secret named RVS_TOKEN in the CI platform. Expose it only to jobs that publish or install packages.

Do not place the token in repository files, workflow logs, container images, build arguments, cache keys, or artifact names.

Select the repository once

Select the repository near the start of the job, then use concise rvs package commands. The selected destination stays explicit without placing a Ravenstash URL or token in package-manager configuration.

rvs art select namespace/repository
rvs pip install internal-sdk

Rotate without downtime

1. Create a separate replacement token with the required access.
2. Update the CI secret.
3. Run a publish or install test.
4. Delete the old token after every job has moved.

Platform guides

• GitHub Actions
• GitLab CI/CD
• Automation tokens