How to use GitHub Actions with Replit

Open your Replit project and navigate to the Git pane by clicking Tools in the left sidebar, then selecting Git. Click 'Connect to GitHub' and authorize Replit to access your GitHub account if you have not already. Create a new repository or select an existing one. Replit will push your current code to the repository. From this point on, every commit you make in Replit syncs to GitHub, and GitHub Actions workflows will trigger automatically.

In your Replit file tree, create the directory structure that GitHub Actions requires. Click the three-dot menu in the file tree and select 'Add folder.' Create a folder called .github, then inside it create another folder called workflows. GitHub automatically detects YAML files in this path and runs them as CI workflows. You may need to enable 'Show hidden files' in the file tree menu to see the .github directory after creating it.

Inside .github/workflows/, create a file called ci.yml. This workflow runs on every push and pull request to the main branch. It checks out your code, installs dependencies, runs your linter, and executes your test suite. The example below is for a Node.js project. Adjust the Node version and commands to match your stack. For Python projects, replace the npm commands with pip install and pytest.

1name: CI
2
3on:
4  push:
5    branches: [main]
6  pull_request:
7    branches: [main]
8
9jobs:
10  test:
11    runs-on: ubuntu-latest
12    steps:
13      - name: Checkout code
14        uses: actions/checkout@v4
15
16      - name: Set up Node.js
17        uses: actions/setup-node@v4
18        with:
19          node-version: '20'
20          cache: 'npm'
21
22      - name: Install dependencies
23        run: npm ci
24
25      - name: Run linter
26        run: npm run lint
27
28      - name: Run tests
29        run: npm test

If your tests or deployment scripts need API keys or tokens, store them as GitHub Secrets rather than hardcoding them. Go to your GitHub repository in the browser, click Settings, then Secrets and variables, then Actions. Click 'New repository secret' and add each secret with a name and value. These secrets are available in your workflow files as ${{ secrets.SECRET_NAME }}. Never store secrets in your workflow YAML files or in your Replit code.

1# Example: using a GitHub Secret in a workflow step
2- name: Deploy to production
3  env:
4    REPLIT_TOKEN: ${{ secrets.REPLIT_TOKEN }}
5  run: |
6    curl -X POST https://your-deploy-webhook-url.replit.app/deploy \
7      -H "Authorization: Bearer $REPLIT_TOKEN"

Create a second workflow file called deploy.yml that triggers only when tests pass on the main branch. This workflow can hit a webhook endpoint on your Replit deployment or use the Replit API to trigger a redeploy. The example below uses a simple webhook approach where your deployed Replit app exposes a /deploy endpoint that pulls the latest code. This is useful when you want GitHub to be the source of truth and Replit to automatically pick up validated changes.

1name: Deploy
2
3on:
4  workflow_run:
5    workflows: [CI]
6    types: [completed]
7    branches: [main]
8
9jobs:
10  deploy:
11    runs-on: ubuntu-latest
12    if: ${{ github.event.workflow_run.conclusion == 'success' }}
13    steps:
14      - name: Trigger Replit redeploy
15        run: |
16          curl -X POST "${{ secrets.REPLIT_DEPLOY_WEBHOOK }}" \
17            -H "Content-Type: application/json" \
18            -H "Authorization: Bearer ${{ secrets.DEPLOY_SECRET }}" \
19            -d '{"ref": "main", "triggered_by": "github_actions"}'

For the deployment trigger to work, your Replit app needs an endpoint that handles the webhook. Add a simple route that validates the authorization header and triggers a git pull or application restart. Store the DEPLOY_SECRET in Replit's Secrets tool (Tools sidebar, then Secrets) so it matches the value in GitHub Secrets. This creates a secure handshake between GitHub Actions and your Replit deployment.

1// Express.js webhook endpoint example
2const express = require('express');
3const { execSync } = require('child_process');
4const app = express();
5
6app.post('/deploy', (req, res) => {
7  const token = req.headers.authorization?.split(' ')[1];
8  if (token !== process.env.DEPLOY_SECRET) {
9    return res.status(401).json({ error: 'Unauthorized' });
10  }
11  try {
12    execSync('git pull origin main', { stdio: 'inherit' });
13    res.json({ status: 'deployed', timestamp: new Date().toISOString() });
14  } catch (error) {
15    res.status(500).json({ error: 'Deploy failed' });
16  }
17});
18
19app.listen(3000, '0.0.0.0', () => {
20  console.log('Server running on port 3000');
21});

With everything in place, make a small change to your code in Replit, commit it via the Git pane, and push to GitHub. Switch to your GitHub repository in the browser and click the Actions tab. You should see the CI workflow running. Once it completes successfully, the Deploy workflow should trigger automatically. Check the workflow logs for any errors and verify your Replit app is serving the updated code.