# CI/CD integration

> Run Shoplazza CLI in CI/CD: authenticate non-interactively with a user access token, then adapt the GitHub Actions and GitLab CI examples to your pipeline.

Shoplazza CLI supports non-interactive authentication and automation for CI/CD pipelines.

## Authentication in CI/CD

Use a User Access Token (UAT) for non-interactive authentication:

```shell
shoplazza auth login --uat $SHOPLAZZA_UAT --store-domain $SHOPLAZZA_STORE
```

Or export the token as `SHOPLAZZA_UAT` and omit `--uat` — `auth login` reads it:

```shell
export SHOPLAZZA_UAT=your-token
shoplazza auth login --store-domain my-store.myshoplaza.com
```

`SHOPLAZZA_STORE` in these examples is your pipeline's own variable holding the store domain; the CLI does not read it. A store login with a UAT needs no `--scope` or `--domain`: the store token gets the scopes already granted to the account.

A UAT login stores no partner token, so `app` commands that call the Partner dashboard (such as `app deploy`) still need a browser `auth login` and won't run on a fresh CI runner. The examples below run a store-level command instead.

## GitHub Actions example

```yaml
name: Deploy Theme
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Shoplazza CLI
        run: npm install -g shoplazza-cli

      - name: Authenticate
        run: shoplazza auth login --uat ${{ secrets.SHOPLAZZA_UAT }} --store-domain ${{ secrets.SHOPLAZZA_STORE }}

      - name: Deploy
        run: shoplazza themes push --theme-id ${{ secrets.SHOPLAZZA_THEME_ID }}
```

## GitLab CI example

```yaml
deploy:
  image: node:20
  stage: deploy
  script:
    - npm install -g shoplazza-cli
    - shoplazza auth login --uat $SHOPLAZZA_UAT --store-domain $SHOPLAZZA_STORE
    - shoplazza themes push --theme-id $SHOPLAZZA_THEME_ID
  only:
    - main
```

## Environment variables

| Variable | Description |
|----------|-------------|
| `SHOPLAZZA_UAT` | User Access Token; `auth login` uses it when `--uat` is omitted |
| `CI` | Set by most CI platforms; turns off interactive prompts and makes `json` the default output format |
| `SHOPLAZZA_CLI_NO_INTERACTIVE` | Turns off interactive prompts where `CI` is not set (same as `--no-input`) |

See [Environment variables](../reference/environment-variables) for the full list.

## Best practices

* **Store secrets securely** — Use your CI/CD platform's secret management, never commit tokens
* **Use minimal scopes** — Request only the scopes needed for your deployment workflow
* **Pin CLI version** — Use `npm install -g shoplazza-cli@x.y.z` for reproducible builds
* **Dry run first** — Test with `--dry-run` in staging before deploying to production