GitOps and the CLI

Your Git repository is the source of truth for integrations, variables, channels, APIs and what runs where, and your pipeline applies it with the weikio CLI. The platform needs no Git credentials and no network path to your Git host, and secret values never go into the repository.

Try Weik.io Read the GitOps docs

From pull request to production

1
A pull request runs the plan
The pull request workflow runs weikio diff with the devtest key and posts its output as a comment: the versions it would create, the variables that change, the deployments that move and what it would delete. If a changed integration has no new version, weikio diff marks it as refused and the check fails before anyone merges.
Terminal
```
$ weikio diff -f ./finance/shared -f ./finance/devtest --env devtest --prune finance
```
2
The merge applies to devtest
On merge to main the devtest workflow applies the integrations, channels, APIs, variables and deployments in one call. Integrations that changed are built once in this step, and the other environments deploy the same versions.
Terminal
```
$ weikio apply -f ./finance/shared -f ./finance/devtest --env devtest --prune finance -y
```

A one-line pull request promotes

Promotion changes the version in the production deployment file, so the reviewer sees exactly what will run.

finance/production/deployments/erp-invoice-export.yaml

# finance/production/deployments/erp-invoice-export.yaml
apiVersion: weik.io/v1
kind: deployment
metadata: { name: erp-invoice-export, project: finance, environment: production }
spec: { version: 1.1.0, state: started }

4
Production applies behind the reviewers
The production workflow plans in a job of its own, and its apply job waits in GitHub's production environment until the required reviewers have read the plan and approved.
Terminal
```
$ weikio apply -f ./finance/production --env production --prune finance -y
```
5
A revert rolls back
A revert of the promotion goes through the same gate and puts the earlier version back without a build. In an incident, weikio rollback works at once, and the next apply from Git puts the desired state back.
Terminal
```
$ git revert a1b2c3d
```

The workflow file

The production workflow for GitHub Actions, with the plan job and the apply job. Any CI system that runs a shell command works the same way.

.github/workflows/production.yaml

name: production
on:
  push:
    branches: [main]
    paths: ['finance/**']
env:
  WEIKIO_SERVER: https://weikio.example.com
jobs:
  plan:                                     # the diff the reviewers read before they approve
    runs-on: ubuntu-latest
    environment: production-plan            # holds the production key, no reviewers
    env:
      WEIKIO_API_KEY: ${{ secrets.WEIKIO_API_KEY }}
    steps:
      - uses: actions/checkout@v4
      - run: |                              # installs the CLI, pinned version, and gives the commit's subject line as the reason
          curl -fsSL https://weik.io/install.sh | WEIKIO_CLI_VERSION=2026.2.1 sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          echo "WEIKIO_REASON=$(git log -1 --format=%s)" >> "$GITHUB_ENV"
      - run: weikio diff -f ./finance/production --env production --prune finance || [ $? -eq 2 ]
  apply:
    needs: plan
    runs-on: ubuntu-latest
    environment: production                 # GitHub's required reviewers gate this job
    env:
      WEIKIO_API_KEY: ${{ secrets.WEIKIO_API_KEY }}
    steps:
      - uses: actions/checkout@v4
      - run: |
          curl -fsSL https://weik.io/install.sh | WEIKIO_CLI_VERSION=2026.2.1 sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          echo "WEIKIO_REASON=$(git log -1 --format=%s)" >> "$GITHUB_ENV"
      - run: printf '%s' "$ERP_API_KEY" | weikio secret set finance/erp-api-key --env production -y
        env:                                # after the approval, like the apply
          ERP_API_KEY: ${{ secrets.ERP_API_KEY }}
      - run: weikio apply -f ./finance/production --env production --prune finance -y

What keeps it safe

Keys per environment

Each repository gets one API key per environment, with the deployer role on its projects. The devtest key can't change production even if someone edits the workflow, and every audit record lists the key and the commit's subject line as the reason.

Docs: Keep integrations in Git

Prune and drift

--prune deletes what the folder no longer has and nothing else. weikio diff --prune exits non-zero when the platform differs from the folder, so a nightly run against production is the drift check.

Docs: Drift and export

Export

weikio export writes every document of a project, or of the whole installation, as YAML that applies again unchanged. Secrets are exported without their values.

Docs: Drift and export

The commit in the audit

The CLI records the repository, branch and commit of every apply from a pipeline. weikio describe integration shows applied from weikio-integrations@a1b2c3d, and the audit record links the commit.

Docs: Audit log

The Audit log filtered to deployment changes, with version changes in devtest and production by Anna Virtanen and the reason given for each — The Audit log lists every change with the person who made it and the reason they gave. You filter it by time, outcome, actor and action, and the `weikio audit query` line above the filters runs the same search.

The CLI

Every weikio command is a call to the platform's HTTP API, and everything the platform does has a command. The apply command publishes a version, deploy runs it in an environment, and run does both while you develop.

weikio --help groups the commands under Getting started, Develop, Deploy and run, Configuration, Events and data, APIs, Agents, Access and Administration. Commands print tables for people and accept -o json and -o yaml for scripts, and completion is available for bash, zsh, fish and PowerShell.

CLI reference

$ curl -fsSL https://weik.io/install.sh | sh

$ irm https://weik.io/install.ps1 | iex

Changes in the admin UI

Changes made in the admin UI are versions like any other, and dialogs show the CLI line that does the same thing. A change saved in the browser is in the audit log with the person who made it, and weikio export writes it out when you want it in Git.

The Grant project access dialog for pekka.niemi@example.com with the role deployer in devtest and the matching weikio member add line — Grant access gives a person a role on a project in the environments you choose, and the dialog shows the `weikio member add` line that does the same.

Editors

Every document kind has a JSON schema, served by the platform at GET /api/v1/schemas/{kind} and kept in the schemas/ folder of the GitHub repository. The YAML language server validates and completes your files with them in Visual Studio Code and other editors.