Integration · CI/CD
GitHub + OrchestrAI
Catalog exported 2026-09-02 · GitHub website
Trigger, cancel, and re-run GitHub Actions workflows and manage repo secrets and variables from chat.
OrchestrAI exposes 17 GitHub operations: 7 are low-risk (read-only or low-impact), and 10 create or modify resources and run only after you confirm the plan. 10 of them also carry a step-level approval gate.
What teams use it for
Engineering teams use OrchestrAI with GitHub Actions to re-run a failed deploy workflow, cancel a run that was started by mistake, and rotate a repository secret in the same conversation. Workflow and run reads are low risk, while trigger, cancel, re-run, enable, disable, and creating a workflow file are medium risk and confirmed. Setting or deleting a secret is high risk because it changes what the pipeline can access, and deleting a variable is treated the same way. There is no operation for pull requests, issues, branches, or organization secrets, so those stay in GitHub.
Every GitHub operation, with its risk level
| Operation | What it does | Risk | Step-level approval |
|---|---|---|---|
Create GitHub Actions Workflow |
Create a GitHub Actions CI/CD workflow | Low risk | No |
Get GitHub Workflow |
Get details of a specific workflow | Low risk | No |
Get Workflow Run |
Get details of a workflow run | Low risk | No |
List GitHub Workflows |
List workflows in a GitHub repository | Low risk | No |
List Repository Secrets |
List secrets in a repository | Low risk | No |
List Repository Variables |
List variables in a repository | Low risk | No |
List Workflow Runs |
List workflow runs in a repository | Low risk | No |
Cancel Workflow Run |
Cancel a running workflow | Creates resources | Yes |
Create GitHub Actions Workflow |
Create a GitHub Actions workflow YAML file in .github/workflows/ | Creates resources | Yes |
Disable GitHub Workflow |
Disable a workflow | Creates resources | Yes |
Enable GitHub Workflow |
Enable a disabled workflow | Creates resources | Yes |
Re-run Workflow |
Re-run a failed or completed workflow | Creates resources | Yes |
Set Repository Variable |
Create or update a repository variable | Creates resources | Yes |
Trigger GitHub Workflow |
Trigger a workflow run via workflow_dispatch | Creates resources | Yes |
Delete Repository Secret |
Delete a repository secret | Modifies existing | Yes |
Delete Repository Variable |
Delete a repository variable | Modifies existing | Yes |
Set Repository Secret |
Create or update a repository secret | Modifies existing | Yes |
Risk tiers come from the catalog: low is read-only or low-impact, medium creates resources and is reversible, high modifies existing resources, destructive may lose data. Every plan that creates or changes resources is shown with its cost estimate and waits for your confirmation. Operations marked with a step-level approval pause again on their own step. Destructive operations require a typed risk phrase.
What you connect
A GitHub credential (stored as github).
Connected-service tokens are envelope-encrypted with a per-record key wrapped by a cloud KMS.
Prompts that work
- Re-run the failed deploy-production workflow run in acme/api from this morning
- Set the repository secret DATABASE_URL in acme/api to the value I paste next
- Disable the nightly-load-test workflow in acme/platform until next week
Before anything runs
Every mutation shows its plan, cost estimate, and blast radius, then waits for your confirmation. Destructive operations require a typed risk phrase. Credentials are minted per run through OIDC federation and discarded afterward; nothing you create here is invisible later, because every resource lands in the desired-state ledger where drift is detected and can be converged. Details on the security page.
Frequently asked questions
- Can OrchestrAI create a GitHub Actions workflow file?
- Yes. It writes the YAML into .github/workflows/ as a medium-risk confirmed operation, so you review the file before it is committed.
- How does OrchestrAI handle GitHub repository secrets?
- Listing shows secret names only, since GitHub does not return values. Creating, updating, or deleting a secret is high risk and waits for confirmation.
- How does OrchestrAI authenticate to GitHub?
- You add a GitHub credential once in the connections screen. It is envelope-encrypted with a per-record key wrapped by a cloud KMS and is only decrypted inside the run that needs it.
Related integrations
Cloud services this pairs with
Try it on your own account
Connect your cloud read-only and see your resources, drift, and costs before anything runs. $5 minimum to start. Unused credits refunded in your first 14 days.
Unused credits refunded in your first 14 days.