CI/CD for Kestra, Deploy and Manage Flows from GitHub

Build a self-managed CI/CD pipeline for your Kestra flows where Kestra deploys Kestra. This blueprint clones a GitHub repository of flow definitions, validates every flow with the Kestra CLI, and pushes the validated flows to one or more production namespaces. It is a GitOps deployment pattern that keeps Git as the single source of truth for your orchestration code, without standing up an external CI tool such as GitHub Actions or Jenkins just to ship YAML.

How it works

All steps run inside a single io.kestra.plugin.core.flow.WorkingDirectory task so the cloned files persist across the validate and deploy steps in one shared workspace:

1. cloneRepository uses io.kestra.plugin.git.Clone to pull the main branch of the GitHub repo containing your flow YAML files.
2. validate_flows runs a io.kestra.plugin.scripts.shell.Commands task on the io.kestra.plugin.core.runner.Process runner, calling kestra flow validate flows/ to check the flows before anything ships.
3. deploy_flows runs kestra flow namespace update against the prod and prod.marketing namespaces with the --no-delete flag, so flows are created or updated without removing flows that are not in the repo.

What you get

• A reproducible, version-controlled deployment path for Kestra flows.
• Pre-deploy validation that catches broken YAML before it reaches production.
• Multi-namespace deployment (prod and prod.marketing) from one run.
• Non-destructive updates via --no-delete.
• A pattern you own end to end, with no external CI runner to maintain.

Who it's for

• Platform and data engineers managing Kestra flows as code.
• Teams adopting GitOps for orchestration.
• Anyone replacing brittle external CI scripts with Kestra-native deployment.

Why orchestrate this with Kestra

Git hosts your code but cannot validate or roll out Kestra flows on its own. Kestra closes that gap: declarative YAML defines the pipeline, retries can be added to each task, every execution is logged with full lineage, and you can drive deployment from event triggers (for example a webhook on a GitHub push) instead of relying on a separate scheduler. The validate step gates the deploy step, so correctness is enforced inside the same execution graph.

Prerequisites

• A running Kestra instance with the Git and Script plugins available.
• A GitHub repository containing your Kestra flow YAML files.
• The kestra CLI available at /app/kestra (default in the official Kestra Docker image).

Secrets

This blueprint clones a public repository and uses no secrets. To deploy from a private repo, add a git authentication token (for example a GITHUB_ACCESS_TOKEN secret) and reference it with {{ secret('GITHUB_ACCESS_TOKEN') }} on the cloneRepository task.

Quick start

1. Add this flow to a namespace on your Kestra instance.
2. Point the url of cloneRepository at your own flows repository.
3. Update the namespaces in deploy_flows to match your environment.
4. Execute the flow and confirm the flows appear in the target namespaces.

How to extend

• Add a io.kestra.plugin.core.trigger.Webhook trigger to deploy on every GitHub push.
• Add retries or a Slack notification on the deploy task.
• Parameterize the branch and namespaces with flow inputs.
• Split validation and deployment into separate flows for staged promotion.

Links

• Git plugin docs
• Git orchestration
• Deploy flows from a flow