Trusted publishing for GitHub Actions is now available on Trigger.dev Cloud and self-hosted instances.
Your workflows can now deploy to Trigger.dev without a Trigger.dev API key stored in your GitHub secrets.
How trusted publishing works
Trusted publishing uses OpenID Connect (OIDC), an open standard for proving who you are with a signed token. GitHub Actions gives your workflow a signed token that says which repository and workflow it is, and Trigger.dev checks it before letting it deploy.
This is a separate feature from OIDC for tasks, which works the other way round. There, Trigger.dev gives your tasks a token so they can access services like Anthropic. Here, GitHub gives your workflow a token so it can deploy to Trigger.dev.
This is safer than a deploy key in your GitHub secrets because only the repository, branch, tag or GitHub Environment you choose can deploy.
Set up trusted publishing
Open Security → Trusted publishing in the dashboard, enter your GitHub organization and repository, then enable each environment you want to deploy to. You can limit it to a branch, a tag or a GitHub Environment (which can have required reviewers), and pin the numeric owner and repository IDs so a renamed or deleted repository can't be taken over.
Then give the workflow id-token: write and deploy with --auth-method oidc:
The CLI never gets a Trigger.dev API key or access to your environment variables. The whole build runs on our build server.
pull_request workflows can deploy to Preview environments. Staging and Production reject PR events, and pull_request_target isn't supported at all.
You'll need the CLI at v4.8.4 or later. The trusted publishing docs cover the full setup.