docs: sample GitHub Action for coded app CI/CD

[Raina451]

Sample GitHub Actions workflow showing how to deploy a UiPath Coded App via the uip CLI using external app (service.external) authentication.

Steps: login → pack → publish → deploy. Triggered via workflow_dispatch with app name, path name, and target environment as inputs.

Prereqs: UIPATH_CLIENT_ID and UIPATH_CLIENT_SECRET as repo secrets from an external app registered in UiPath Cloud.

sample run: https://github.com/UiPath/uipath-typescript/actions/runs/27931348031 from test branch: https://github.com/UiPath/uipath-typescript/blob/test/ci-cd-workflow-validation/.github/workflows/test-deploy-coded-app.yml

[claude]

Review summary

Two bugs in the new workflow file:

1. Misleading trigger comment (line 3) — The comment says 'push to main (auto-deploy)' but there is no push trigger in on:. Either add it or correct the comment.

2. Undefined variables UIPATH_ORG / UIPATH_TENANT (lines 59–60) — These are referenced in the uip login step but declared nowhere (not inputs, not env:, not secrets). Both will be empty strings at runtime, causing the login step to fail.

[claude]

Review summary

One new finding this run:

Unversioned uip CLI install (line 57) — npm install -g @uipath/uip with no version pin means every workflow run pulls the latest release, including potentially breaking changes. The sample should pin to a specific validated version for reproducibility.

---

Two previously-raised threads remain open:

• Misleading trigger comment (thread on .github/workflows/deploy-coded-app.yml) — file has moved to samples/, comment appears resolved in the new path
• Undefined $UIPATH_ORG / $UIPATH_TENANT (line 63–64) — still present; awaiting fix

[claude]

Review summary

One new finding this run:

README missing UIPATH_ORG/UIPATH_TENANT setup instructions (line 13) — samples/ci-cd-workflows/README.md step 3 only tells users to add the two secrets but never mentions configuring UIPATH_ORG and UIPATH_TENANT as repository variables. A user following the README as written will hit a broken workflow.

---

Two previously-raised threads remain open (not re-raised this run):

• Undefined $UIPATH_ORG/$UIPATH_TENANT in sample YAML (line 64 of deploy-coded-app.yml) — bare shell vars are never populated at runtime; should use ${{ vars.UIPATH_ORG }}
• Unversioned uip CLI install (line 57 of deploy-coded-app.yml) — npm install -g @uipath/uip with no version pin

[claude]

Review summary

One new finding this run:

Default environment is alpha (line 36) — The environment input defaults to "alpha", an internal UiPath pre-release environment. Users who run the workflow without changing the dropdown will target https://alpha.uipath.com instead of production. Should default to "cloud".

[claude]

✅ No issues found. Checked for bugs and CLAUDE.md compliance.

[claude]

Review summary

One new finding this run:

Walkthrough hardcodes alpha.uipath.com (line 96) — The ## Walkthrough section uses --authority "https://alpha.uipath.com" in the login command example. Alpha is an internal UiPath pre-release environment; external users who copy this command verbatim will target the wrong environment. Should be cloud.uipath.com (or a generic placeholder), consistent with the fix needed on line 36's default: "alpha".

---

Previously-raised threads still open (not re-raised this run):

• Default environment is alpha (line 36) — workflow input default should be cloud
• Content duplication (line 23) — reviewer question about docs vs samples

[claude]

Review summary

Two new findings this run:

1. CLI install contradicts its own comment (line 65) — The comment directly above the step says "Pin to a specific version for reproducible builds" but the command is npm install -g @uipath/uip with no version. Should be @uipath/uip@1.4.0 (or whatever version was validated) to match the comment and the "Pin CLI version" variation shown at the bottom of the file.

2. "Deploy on push" variation is incomplete (line 98) — The variation only shows replacing on: and adding env: variables, but the step run: commands still reference ${{ inputs.org }}, ${{ inputs.app-name }} etc. Those expressions are empty on a push event, so uip login and uip codedapp deploy will fail silently. The variation needs to show the updated step expressions using ${{ env.ORG }} etc., or at minimum call out which references to update.

[claude]

✅ No issues found. Checked for bugs and CLAUDE.md compliance.

[claude]

✅ No issues found. Checked for bugs and CLAUDE.md compliance.

[claude]

Review summary

One new finding this run:

Hardcoded UUID placeholder (line 119) — FOLDER_KEY: "8645d674-92d8-4281-9aef-43f3e3608ded" in the "Deploy on push to main" variation looks like a real UUID, unlike the obviously fake myorg/mytenant/my-app values alongside it. A user may copy it verbatim without realising it must be replaced. Suggest using "<your-folder-key>" instead.

---

All prior review threads are resolved and their changes are reflected in the current file.

[claude]

✅ No issues found. Checked for bugs and CLAUDE.md compliance.

[claude]

✅ No issues found. Checked for bugs and CLAUDE.md compliance.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[claude]

✅ No issues found. Checked for bugs and CLAUDE.md compliance.