GitHub Actions
Call the deployment gate API before deploying from a trusted branch. The check reports stored vendor status and fails when a selected service has a major outage or cannot be matched.
1. Save the deployment check
Save this as scripts/check-upstream.mjs. It runs on Node.js 24 without additional packages.
CHECKUPSTREAM_API_TOKEN: a read-scopedcup_api_token stored in CI secrets.CHECKUPSTREAM_SERVICES: comma-separated slugs your organization tracks, such asstripe,openai.
const token = process.env.CHECKUPSTREAM_API_TOKEN;
const services = process.env.CHECKUPSTREAM_SERVICES;
if (!token || !services?.trim()) {
throw new Error("Set CHECKUPSTREAM_API_TOKEN and CHECKUPSTREAM_SERVICES in CI");
}
const url = new URL(
"/api/v1/deploy-gate",
process.env.CHECKUPSTREAM_BASE_URL || "https://checkupstream.com",
);
url.searchParams.set("services", services);
const response = await fetch(url, {
headers: { Authorization: `Bearer ${token}` },
signal: AbortSignal.timeout(20_000),
});
if (!response.ok) throw new Error(`Deployment check failed: HTTP ${response.status}`);
const gate = await response.json();
console.log(JSON.stringify(gate, null, 2));
if (
gate?.safe !== true ||
!Number.isInteger(gate.totalServicesChecked) ||
gate.totalServicesChecked <= 0
) {
process.exitCode = 1;
}2. Run it from GitHub Actions
Add the token as a repository secret and the service slugs as a repository variable. This example runs on main or manual dispatch. Add needs: check-upstream to your deployment job; a standalone check does not block other jobs.
name: Upstream deployment check
on:
push:
branches: [main]
workflow_dispatch:
jobs:
check-upstream:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 24
- name: Check selected vendors
run: node scripts/check-upstream.mjs
env:
CHECKUPSTREAM_API_TOKEN: ${{ secrets.CHECKUPSTREAM_API_TOKEN }}
CHECKUPSTREAM_SERVICES: ${{ vars.CHECKUPSTREAM_SERVICES }}This script blocks deployment for: a recorded major outage, unmatched services, empty results, invalid responses, failed requests or missing configuration.
It does not block for: degraded, partial-outage, maintenance or unknown status. It does not check how old a status is. The API response omits observation dates; check the vendor's status page for that context.
This checks stored vendor status, so a passing result cannot guarantee a safe deployment or confirm application health. Your deployment job must require this check.
Continue your setup
Review the endpoints and credentials used by your integration.