---
title: "Automate with GitHub Actions"
description: "Share a build artifact from a GitHub Actions workflow with the official Tarkle Action."
---

> Documentation Index
> Fetch the complete documentation index at: https://tarkle.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Automate with GitHub Actions

[`tarkleHQ/upload-action`](https://github.com/tarkleHQ/upload-action) uploads one or more files from a
workflow run to Tarkle and returns a shareable link -- for sharing a build, a report or a release
candidate straight from CI, without writing any API calls yourself. It wraps
[`@tarkle/cli`](https://www.npmjs.com/package/@tarkle/cli) and the [Transfers API](/docs/api/transfers)
directly, so it stays in step with the API itself.

## Quick start

1. Create an API key at **Settings → API** and save it as a repository secret (for example
   `TARKLE_API_KEY`). Save your workspace key (shown on the same page) as a second secret
   (`TARKLE_WORKSPACE`).
2. Add a step to your workflow:

```yaml
- name: Share the build
  id: tarkle
  uses: tarkleHQ/upload-action@v1
  with:
    api-key: ${{ secrets.TARKLE_API_KEY }}
    workspace: ${{ secrets.TARKLE_WORKSPACE }}
    files: dist/application.zip
    duration: 7d

- name: Print the share link
  run: echo "${{ steps.tarkle.outputs.url }}"
```

3. The step's outputs (`url`, `id`, `expires-at`, `result`) are available to later steps, a job summary,
   or a PR comment.

## Password-protected and one-time links

```yaml
- uses: tarkleHQ/upload-action@v1
  with:
    api-key: ${{ secrets.TARKLE_API_KEY }}
    workspace: ${{ secrets.TARKLE_WORKSPACE }}
    files: build/release.zip
    password: ${{ secrets.RELEASE_PASSWORD }}
    burn-after-read: true
```

See the [Action's own README](https://github.com/tarkleHQ/upload-action#readme) for the full inputs and
outputs reference, including uploading into a specific library folder and handling several files at once.

## Security

Pin the Action to a full commit SHA (`uses: tarkleHQ/upload-action@<sha>`) instead of the `v1` tag when
your workflow runs on untrusted input, such as a fork's pull request -- the same guidance any third-party
Action deserves. The Action never logs your API key or password; file bytes go straight to Tarkle's object
storage through short-lived presigned URLs, the same engine this API's own uploads use.

Source: https://tarkle.com/docs/api/github-actions/index.mdx