feat(actions): Add Github actions package

[ecton-transcend]

Related Issues

• closes https://linear.app/transcend/issue/WAL-9270

Public Changelog

• Added: transcend-io/tools/github-action — a composite GitHub Action (Transcend Custom Functions Sync) that keeps Transcend custom functions in sync with source code in a client's own repository. On every push it creates missing functions and pushes new code revisions for changed ones, with inputs for dry-run previews on pull requests, draft-only pushes (promote: 'false'), forced re-signs for env-value rotations, self-hosted Sombra authentication (sombra-auth), and writing assigned function IDs back into the manifest (update-manifest).

Internal Changelog

• Added: github-action/ with action.yml, README, and a worked example (manifest + Deno function) that clients can copy.

Part 3 of 3, stacked on #322 (the transcend custom-functions push CLI command) and #321 (the SDK helpers). Retarget to main after #322 merges. Usable via uses: transcend-io/tools/github-action@main once merged — no separate publish step needed, though tagging a v1 release is recommended for pinning.

Implementation details

How it works

• The action is a thin composite wrapper: it sets up Node 22, maps its kebab-case inputs to CLI flags, and runs npx --package=@transcend-io/cli@{cli-version} -- transcend custom-functions push. All sync logic (customer-ingress code signing, change detection, draft + promote) lives in the CLI/SDK from the earlier PRs in this stack.
• Code is signed directly against the customer's Sombra gateway over TLS via the new /v1/custom/sign route — code and env values never reach Transcend's backend in plaintext.
• The API key is passed via the TRANSCEND_API_KEY environment variable; the optional sombra-auth input forwards the Sombra internal key (needed when self-hosting) as --sombraAuth. Manifests spanning self-hosted gateways with different internal keys set sombra-auth-env per entry and export the named variables via the action step's env: block (documented in the README).
• cli-version defaults to latest but can be pinned for reproducible builds.
• The job fails if any function fails to sync, so a red check means Transcend is out of sync with the repository.

Key files

• Action definition: github-action/action.yml
• Client-facing docs (prerequisites, ID/name matching rules, example workflow): github-action/README.md
• Copyable example: github-action/examples/

Security Implications

• The action requires an API key with the existing Manage Data Map scope, documented to be stored as a GitHub Actions secret; the optional Sombra internal key is likewise a secret input.
• Function code and env values are signed and encrypted by the customer's own Sombra gateway inside the CLI — nothing in this action handles plaintext secrets beyond forwarding the inputs.

[linear-code]

WAL-9270

[pkg-pr-new]

Open in StackBlitz

@transcend-io/airgap.js-types

pnpm add https://pkg.pr.new/@transcend-io/airgap.js-types@323

yarn add https://pkg.pr.new/@transcend-io/airgap.js-types@323.tgz

@transcend-io/cli

pnpm add https://pkg.pr.new/@transcend-io/cli@323

yarn add https://pkg.pr.new/@transcend-io/cli@323.tgz

@transcend-io/design-tokens

pnpm add https://pkg.pr.new/@transcend-io/design-tokens@323

yarn add https://pkg.pr.new/@transcend-io/design-tokens@323.tgz

@transcend-io/internationalization

pnpm add https://pkg.pr.new/@transcend-io/internationalization@323

yarn add https://pkg.pr.new/@transcend-io/internationalization@323.tgz

@transcend-io/privacy-types

pnpm add https://pkg.pr.new/@transcend-io/privacy-types@323

yarn add https://pkg.pr.new/@transcend-io/privacy-types@323.tgz

@transcend-io/sdk

pnpm add https://pkg.pr.new/@transcend-io/sdk@323

yarn add https://pkg.pr.new/@transcend-io/sdk@323.tgz

@transcend-io/type-utils

pnpm add https://pkg.pr.new/@transcend-io/type-utils@323

yarn add https://pkg.pr.new/@transcend-io/type-utils@323.tgz

@transcend-io/utils

pnpm add https://pkg.pr.new/@transcend-io/utils@323

yarn add https://pkg.pr.new/@transcend-io/utils@323.tgz

@transcend-io/mcp

pnpm add https://pkg.pr.new/@transcend-io/mcp@323

yarn add https://pkg.pr.new/@transcend-io/mcp@323.tgz

@transcend-io/mcp-server-admin

pnpm add https://pkg.pr.new/@transcend-io/mcp-server-admin@323

yarn add https://pkg.pr.new/@transcend-io/mcp-server-admin@323.tgz

@transcend-io/mcp-server-assessment

pnpm add https://pkg.pr.new/@transcend-io/mcp-server-assessment@323

yarn add https://pkg.pr.new/@transcend-io/mcp-server-assessment@323.tgz

@transcend-io/mcp-server-base

pnpm add https://pkg.pr.new/@transcend-io/mcp-server-base@323

yarn add https://pkg.pr.new/@transcend-io/mcp-server-base@323.tgz

@transcend-io/mcp-server-consent

pnpm add https://pkg.pr.new/@transcend-io/mcp-server-consent@323

yarn add https://pkg.pr.new/@transcend-io/mcp-server-consent@323.tgz

@transcend-io/mcp-server-discovery

pnpm add https://pkg.pr.new/@transcend-io/mcp-server-discovery@323

yarn add https://pkg.pr.new/@transcend-io/mcp-server-discovery@323.tgz

@transcend-io/mcp-server-docs

pnpm add https://pkg.pr.new/@transcend-io/mcp-server-docs@323

yarn add https://pkg.pr.new/@transcend-io/mcp-server-docs@323.tgz

@transcend-io/mcp-server-dsr

pnpm add https://pkg.pr.new/@transcend-io/mcp-server-dsr@323

yarn add https://pkg.pr.new/@transcend-io/mcp-server-dsr@323.tgz

@transcend-io/mcp-server-inventory

pnpm add https://pkg.pr.new/@transcend-io/mcp-server-inventory@323

yarn add https://pkg.pr.new/@transcend-io/mcp-server-inventory@323.tgz

@transcend-io/mcp-server-preferences

pnpm add https://pkg.pr.new/@transcend-io/mcp-server-preferences@323

yarn add https://pkg.pr.new/@transcend-io/mcp-server-preferences@323.tgz

@transcend-io/mcp-server-workflows

pnpm add https://pkg.pr.new/@transcend-io/mcp-server-workflows@323

yarn add https://pkg.pr.new/@transcend-io/mcp-server-workflows@323.tgz

commit: 59efb48

[ecton-transcend]

🤖 Posted by Cursor on behalf of @ecton-transcend

Automated Change: Auth pivot to customer-ingress signing

Per security review feedback on the platform side (#46175), the signing flow no longer exchanges the API key for a Sombra employee session over a Diffie-Hellman channel. The CLI now signs code directly against the Sombra customer-ingress /v1/custom/sign route (bearer token auth) and saves the pre-signed JWTs via GraphQL.

Implementation details

What changed: All DH crypto and the session-exchange helper were removed from the SDK; a signCustomFunctionCode customer-ingress client and resolveSombraCustomerUrl helper were added; the GraphQL mutations now receive signedCodeJwt / signedCodeContextJwt inside input instead of dhEncrypted; the CLI gained --sombraAuth (Sombra internal key, needed when self-hosting) and the action a matching sombra-auth input.
Why: The employee-session exchange hard-coded SombraEmployeeAuthMethod.Transcend, which is not enabled on all self-hosted gateways; the customer-ingress bearer token is the established auth model for internal routes.
Impact: Same trust model at rest (backend stores unverifiable HMAC JWTs either way); code/env plaintext now travels only over TLS to the customer's own gateway. Requires a Sombra version with the new route — older gateways get a friendly upgrade error.