GitOps — PR plan / merge apply

Treat iap.yaml as desired state in Git: review diffs in pull requests, apply on merge. Like Atlantis, but for your app-store catalog.

PR opened ──▶ iapctl plan -o json ──▶ sticky PR comment (3-store diff, drift ~)
merge main ──▶ iapctl apply       ──▶ resources created / drift corrected

Your store keys stay in your repository’s GitHub Secrets. storectl Cloud is not involved in these free-CLI flows.

Composite action

storectl ships a composite action that runs the CLI, renders the report to the job summary, posts a sticky PR comment (updated in place per tool+command), and surfaces a terraform-style exit code.

- uses: ./.storectl/.github/actions/storectl-comment
  with:
    bin: ${{ runner.temp }}/iapctl
    command: plan          # or: apply
    config: iap.yaml
    post-comment: "true"
    fail-on-changes: "false"   # plan diffs are informational; don't block the PR

PR plan workflow

name: iap-plan
on: pull_request
permissions: { contents: read, pull-requests: write }
jobs:
  plan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: curl -fsSL https://storectl.dev/install.sh | sh   # or build from source
      - uses: storectl-dev/storectl/.github/actions/storectl-comment@v1
        with: { command: plan, config: iap.yaml }
        env:
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
          REVENUECAT_API_KEY: ${{ secrets.REVENUECAT_API_KEY }}   # omit if unused

Apply on merge

name: iap-apply
on: { push: { branches: [main], paths: ["iap.yaml"] } }
concurrency: { group: iap-apply }   # never two applies at once
jobs:
  apply:
    runs-on: ubuntu-latest
    environment: production   # optional: require a reviewer
    steps:
      - uses: actions/checkout@v4
      - run: curl -fsSL https://storectl.dev/install.sh | sh
      - uses: storectl-dev/storectl/.github/actions/storectl-comment@v1
        with: { command: apply, config: iap.yaml, post-comment: "false" }
        env: { /* same secrets as above */ }

metactl works the same way — set tool: metactl and config: metadata.yaml to run GitOps over App Review text metadata.

Ready-to-copy samples live in the storectl repo under examples/github-actions/. See also Drift detection.