Updatecli
Docs

Sending reports

Description

Your manifests stay the same. At the end of a run, Updatecli sends each pipeline’s report to Udash. It needs three things from you: where to publish, a token if the instance requires one, and the --experimental flag.

Warning

Without --experimental, nothing is published. Updatecli prints no warning and the run reports success, even when an endpoint and a token are configured.

From your laptop

updatecli udash login "https://udash.example.com" --experimental

If the instance requires authentication, the command opens its token page in a browser and asks you to paste an API token. Create one there, under Profile then Tokens. The command checks the token before saving it, so a wrong token fails immediately.

If the API is not at the given URL followed by /api, set it with --api-url:

updatecli udash login --api-url "https://api.example.com/api" "https://udash.example.com" --experimental

updatecli udash config prints where the settings were saved, and updatecli udash logout removes them. The updatecli udash login reference lists every flag.

Then run Updatecli with --experimental:

updatecli diff --experimental

Each pipeline ends with a link to its stored report:

UDASH - EXPERIMENTAL
=====================

Publishing report to Udash
my pipeline:
	=> "https://udash.example.com/pipeline/reports/8f2b1c94-...."

From CI

Use environment variables instead of udash login:

VariablePurpose

UPDATECLI_UDASH_URL

The Udash URL, used to build the report links.

UPDATECLI_UDASH_API_URL

The API URL. Nothing is published when it is unset.

UPDATECLI_UDASH_ACCESS_TOKEN

The Udash API token, when the instance requires one.

A variable wins over the value saved by udash login.

- name: Run Updatecli
  env:
    UPDATECLI_UDASH_URL: https://udash.example.com
    UPDATECLI_UDASH_API_URL: https://udash.example.com/api
    UPDATECLI_UDASH_ACCESS_TOKEN: ${{ secrets.UDASH_TOKEN }}
  run: updatecli apply --experimental

The token needs the reports:write scope, which new tokens get by default. See GitHub Actions and Jenkins for the surrounding job.

Making reports easy to find

The interface is organised per Git repository and filtered by label. A report with neither is stored, but you can only reach it through the full report list.

updatecli.yaml
name: Bump the base image
pipelineid: docker/base-image

labels:
  ecosystem: docker
  monitor: active

# The scm files the reports under this Git repository in Udash.
scms:
  default:
    kind: github
    spec:
      owner: my-org
      repository: my-service
      branch: main
      token: '{{ requiredEnv "GITHUB_TOKEN" }}'

sources:
  alpine:
    name: Get the latest Alpine version
    kind: dockerimage
    spec:
      image: alpine
      versionfilter:
        kind: semver

targets:
  dockerfile:
    name: Update the Alpine base image
    kind: dockerfile
    scmid: default
    sourceid: alpine
    spec:
      file: Dockerfile
      instruction:
        keyword: FROM
        matcher: alpine

  • An scm referenced through scmid files the pipeline under its Git repository and puts it on the Git dashboard.

  • Labels feed the filters. See Choosing labels.

Udash rejects a label with an empty value. Leave the label out instead of setting it to "".

When nothing arrives

SymptomFix

No UDASH - EXPERIMENTAL section, no warning

Add --experimental.

no Udash endpoint detected, skipping

Run updatecli udash login, or set UPDATECLI_UDASH_API_URL. Add --debug to see which source Updatecli read.

403 with token is not allowed to perform this action

Your token cannot write reports. Create a token with the reports:write scope, or ask the instance administrator for the publisher role.

Problems on the server side, such as sign-in or tokens that are always rejected, are covered in the updatecli/udash repository.

Go further

Last updated on September 26, 2026
Prev
Source
Next
Bazelregistry