Diagrams from your code, behind your single sign-on

On every pull request, GitHub Actions redraws your diagrams from the code and publishes them to your private library. No stored keys.

Talk to usRead the trusted publishers guide (opens in a new tab)

Once, in the portal under Keys and CI, an admin adds a trusted publisher: GitHub Actions, the repository parcelpoint/checkout and its workflow file diagrams.yml, able to publish diagrams and report drift. It is added and valid.

One pull request, from the check to the library. A sample organisation; the check output is a real run.
  1. GitHub ActionsAsks GitHub for a signed OpenID Connect token. No secret in the repository.
  2. PlotworkChecks the repository by its GitHub id, and gives a token that lives 15 minutes.
  3. Your libraryDiagrams land in folders only the roles and people you choose can open.

One workflow file, no key to rotate

Name the repository and its workflow file once in the portal. Every run after that signs itself in.

  • Pinned to the repositoryGitHub's numeric ids for the repository and its owner are pinned, so a repository made again under the same name is refused.
  • Scoped to what you allowPublish to the library, report drift, or both. Never read the audit log. Narrow it to a deployment environment or a branch.
  • Short-lived by designEach token lives 15 minutes. Plotwork keeps only a SHA-256 of it, never the token and no secret of yours.
.github/workflows/diagrams.yml
name: diagramson:  pull_request:  push:    branches: [main]permissions:  contents: read  id-token: writejobs:  diagrams:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v7        with:          persist-credentials: false      # Sign in as a trusted publisher: the second tab, until Action v1.2.0      - uses: plotwork-official/plotwork-action@86ae8278fa771a422d9df60185182f14b8be4db9 # v1.1.0        with:          command: generate          mode: check          report-drift: true

Action v1.1.0 needs one step to sign in. From v1.2.0 it signs in by itself and the step goes.

What your platform and security teams get

Each one is a setting in the portal, written to the audit log when it changes.

And around it

A library your organisation controls

Everything CI publishes goes to the organisation, not to a public link. Single sign-on decides who is in it, and roles decide what each person can do.

How organisations work (opens in a new tab)
What each role may do
ActionOwnerAdminMemberReader
See the library and download a diagramYesYesYesYes
Publish a diagramYesYesYesNo
Approve held publishesYesYesIf chosenNo
Make the organisation's keysYesYesNoNo
Set up single sign-on and send audit events to your toolsYesYesNoNo
Change a member's roleYesNoNoNo

Roll it out across every repository

One reusable workflow, a required check, and a library behind your identity provider. Tell us how many repositories you run.

Talk to usRead the rollout guide (opens in a new tab)