GitHub Actions

There is no action to install. The CLI runs under npx, so a deploy is one step in a workflow, and pinning the version is the only setup worth doing:

Code
name: Publish
on:
  push:
    branches: [main]

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - run: npm ci && npm run build

      - name: Publish to Drop2Run
        id: publish
        env:
          DROP2RUN_TOKEN: ${{ secrets.DROP2RUN_TOKEN }}
        run: |
          npx --yes drop2run@1.3.0 deploy dist --site my-docs --json > result.json
          echo "url=$(jq -r .url result.json)" >> "$GITHUB_OUTPUT"

      - name: Say where it went
        run: echo "Published ${{ steps.publish.outputs.url }}" >> "$GITHUB_STEP_SUMMARY"

Four things about that are deliberate:

• --site is named, not left to drop2run.json. Both work, and either is better than neither: with no site at all every run creates a new one, so a workflow on every push would leave a trail of sites and a URL nobody is looking at. Committing drop2run.json and dropping --site is the same decision made in the repository instead of the workflow.
• The version is pinned. npx drop2run without one takes whatever is latest at the moment the job runs, which is a deploy step that can change under you between two identical commits.
• The token is a secret, and the only one needed. Create it at Account → Access tokens — neither login flow works in CI, since nothing there can open a browser or approve a code. Authentication has the steps.
• The URL comes out of --json, not out of the log. Parsing the human line would break the first time it was reworded; the JSON is the contract.

unchanged: true in that file means the commit changed nothing the site serves, so no version was published. Worth branching on if the workflow announces deploys somewhere: it is a success, and announcing it as a new deploy would be wrong.

Other CI systems

Nothing above is specific to GitHub beyond $GITHUB_OUTPUT and the uses: steps. Anywhere that can run Node and hold a secret works the same way: set DROP2RUN_TOKEN, run `npx --yes drop2run@ deploy