CI should upload agent source to Salambo. It should not build the hosted sandbox image or receive platform registry and sandbox credentials.

​
Required CI authority

CI needs:
  • the Salambo application URL;
  • a scoped Salambo API key;
  • secret environment variables referenced by salambo.yaml.
Store these in the organization or repository secret manager.

​
Example workflow

export SALAMBO_API_KEY="$CI_SALAMBO_API_KEY"
export OPENAI_API_KEY="$CI_OPENAI_API_KEY"

salambo auth set \
  --api-url "$SALAMBO_BASE_URL" \
  --key "$SALAMBO_API_KEY" \
  --profile ci

salambo doctor --profile ci
salambo manifest --path . --json
salambo deploy --profile ci
salambo smoke "CI deployment smoke test" --profile ci
salambo doctor currently checks Git, Docker, and the configured local compose file as well as deployment configuration and credentials. If your deployment job intentionally omits local-template tooling, run the manifest and deployment commands directly and keep the project tests as the CI prerequisite.

​
Responsibility split

CIHosted deployment worker
Validate source and configResolve the managed base release
Compile the manifestGenerate the managed build context
Upload the source archiveBuild the sandbox image
Create the deploymentPrepare the managed runtime
Supply declared provider secretsActivate the immutable deployment
  1. Run project tests.
  2. Run salambo doctor when the runner includes the local-template prerequisites.
  3. Compile the manifest.
  4. Deploy from a clean commit.
  5. Wait for the deployment to become ready.
  6. Run one bounded hosted smoke test.
  7. Keep the previous deployment available for rollback.
Do not use personal keys for shared CI. Use organization-owned authority with only the required scopes.