CI/CD

Trigger Drizz test plans from GitHub Actions, Jenkins, GitLab CI and others — and what a pipeline cannot do yet.

Any CI/CD system that can make an authenticated HTTP request can start a Drizz run: authenticate, upload the build, trigger the plan.

Platforms	GitHub Actions · Jenkins · GitLab CI · Bitbucket Pipelines · Azure DevOps
Requirement	Anything that can make an authenticated HTTP request
Env vars	DRIZZ_BASE_URL, DRIZZ_API_KEY
Pipeline does	authenticate → upload → trigger
Watch out	The trigger step succeeds even if every test later fails

Prerequisites

• Client ID, client secret, auth host and audience, issued by Drizz

• API base URL for your organization

• Test plan ID, from the web app

• A CI secret store holding all five values

• curl and jq available on the build agent

What a pipeline can and cannot do

Consequence	Detail
The trigger step goes green as soon as the run is triggered	It reports the trigger, not the test outcome
A build cannot be failed on a Drizz test failure	No run status is available to the pipeline
Results are read by a person	Open the report in the Drizz web app

Copy this

#!/usr/bin/env bash
set -euo pipefail

# Secrets come from your CI secret store, never from the repository
: "${DRIZZ_BASE_URL:?}" "${DRIZZ_AUTH_DOMAIN:?}" "${DRIZZ_CLIENT_ID:?}"
: "${DRIZZ_CLIENT_SECRET:?}" "${DRIZZ_AUDIENCE:?}"

# 1 — fresh token for this run
DRIZZ_API_KEY=$(curl -sf -X POST "https://${DRIZZ_AUTH_DOMAIN}/oauth/token" \
  -H "Content-Type: application/json" \
  -d "{\"client_id\":\"${DRIZZ_CLIENT_ID}\",\"client_secret\":\"${DRIZZ_CLIENT_SECRET}\",\"audience\":\"${DRIZZ_AUDIENCE}\",\"grant_type\":\"client_credentials\"}" \
  | jq -r .access_token)

# 2 — upload the build
curl -sf -X POST "${DRIZZ_BASE_URL}/apk/upload" \
  -H "x-api-key: ${DRIZZ_API_KEY}" \
  -F "file=@app-release.apk" | tee upload.json

# 3 — trigger the plan against the version just uploaded
VERSION=$(jq -r .details.version_name upload.json)
curl -sf -X POST "${DRIZZ_BASE_URL}/testplan/run" \
  -H "x-api-key: ${DRIZZ_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "{\"test_plan_id\":\"ADuF4ViN\",\"apks\":{\"com.shopease.android\":\"${VERSION}\"}}" \
  | tee trigger.json

# The run has started. Open the report in the Drizz web app for the outcome.
echo "execution_id: $(jq -r .execution_details.execution_id trigger.json)"

Pipeline steps

1. Request an access token.

2. Upload the build — only when the app version changed.

3. Trigger one test plan, or a batch.

4. Record the execution_id in the build log.

5. Archive the trigger response as a build artifact.

6. Open the report in the Drizz web app to read the outcome. This step is manual.

Supported platforms

The integration is identical on every platform. Only the surrounding syntax changes.

Platform	Trigger points
GitHub Actions	Pull requests, merges, manual dispatch
Jenkins	Scripted or declarative pipelines
GitLab CI	Branch pipelines, scheduled jobs
Bitbucket Pipelines	Build or release stages
Azure DevOps	Release pipelines

Platform examples

Both examples trigger a run and finish. Each passes whether the tests pass or fail. The step that would wait for the result is marked in the file and deliberately not written, because there is no endpoint to call.

GitHub Actions

name: Drizz regression

on:
  workflow_dispatch:
  push:
    branches: [main]

jobs:
  drizz:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build the app
        run: ./gradlew assembleRelease

      - name: Authenticate with Drizz
        id: auth
        env:
          DRIZZ_AUTH_DOMAIN: ${{ secrets.DRIZZ_AUTH_DOMAIN }}
          DRIZZ_CLIENT_ID: ${{ secrets.DRIZZ_CLIENT_ID }}
          DRIZZ_CLIENT_SECRET: ${{ secrets.DRIZZ_CLIENT_SECRET }}
          DRIZZ_AUDIENCE: ${{ secrets.DRIZZ_AUDIENCE }}
        run: |
          TOKEN=$(curl -sf -X POST "https://${DRIZZ_AUTH_DOMAIN}/oauth/token" \
            -H "Content-Type: application/json" \
            -d "{\"client_id\":\"${DRIZZ_CLIENT_ID}\",\"client_secret\":\"${DRIZZ_CLIENT_SECRET}\",\"audience\":\"${DRIZZ_AUDIENCE}\",\"grant_type\":\"client_credentials\"}" \
            | jq -r .access_token)
          echo "::add-mask::$TOKEN"
          echo "token=$TOKEN" >> "$GITHUB_OUTPUT"

      - name: Upload the build
        env:
          DRIZZ_BASE_URL: ${{ secrets.DRIZZ_BASE_URL }}
          DRIZZ_API_KEY: ${{ steps.auth.outputs.token }}
        run: |
          curl -sf -X POST "${DRIZZ_BASE_URL}/apk/upload" \
            -H "x-api-key: ${DRIZZ_API_KEY}" \
            -F "file=@app/build/outputs/apk/release/app-release.apk" \
            | tee upload.json

      - name: Trigger the test plan
        env:
          DRIZZ_BASE_URL: ${{ secrets.DRIZZ_BASE_URL }}
          DRIZZ_API_KEY: ${{ steps.auth.outputs.token }}
        run: |
          VERSION=$(jq -r .details.version_name upload.json)
          curl -sf -X POST "${DRIZZ_BASE_URL}/testplan/run" \
            -H "x-api-key: ${DRIZZ_API_KEY}" \
            -H "Content-Type: application/json" \
            -d "{\"test_plan_id\":\"ADuF4ViN\",\"apks\":{\"com.shopease.android\":\"${VERSION}\"}}" \
            | tee trigger.json
          echo "Started: $(jq -r .execution_details.execution_id trigger.json)"

      # BLOCKED — a "wait for the run and fail on failure" step goes here.
      # It needs a run-status endpoint, which does not exist yet.
      # Until then this workflow reports that a run started, not whether it passed.

      - name: Keep the trigger record
        uses: actions/upload-artifact@v4
        with:
          name: drizz-trigger
          path: |
            upload.json
            trigger.json

Jenkins

pipeline {
  agent any

  environment {
    DRIZZ_BASE_URL   = credentials('drizz-base-url')
    DRIZZ_AUTH       = credentials('drizz-auth-domain')
    DRIZZ_AUDIENCE   = credentials('drizz-audience')
    DRIZZ_CLIENT     = credentials('drizz-client-id')
    DRIZZ_SECRET     = credentials('drizz-client-secret')
    TEST_PLAN_ID     = 'ADuF4ViN'
    PACKAGE_NAME     = 'com.shopease.android'
  }

  stages {
    stage('Build') {
      steps {
        sh './gradlew assembleRelease'
      }
    }

    stage('Authenticate') {
      steps {
        script {
          env.DRIZZ_API_KEY = sh(
            returnStdout: true,
            script: '''
              curl -sf -X POST "https://${DRIZZ_AUTH}/oauth/token" \
                -H "Content-Type: application/json" \
                -d "{\\"client_id\\":\\"${DRIZZ_CLIENT}\\",\\"client_secret\\":\\"${DRIZZ_SECRET}\\",\\"audience\\":\\"${DRIZZ_AUDIENCE}\\",\\"grant_type\\":\\"client_credentials\\"}" \
                | jq -r .access_token
            '''
          ).trim()
        }
      }
    }

    stage('Upload') {
      steps {
        sh '''
          curl -sf -X POST "${DRIZZ_BASE_URL}/apk/upload" \
            -H "x-api-key: ${DRIZZ_API_KEY}" \
            -F "file=@app/build/outputs/apk/release/app-release.apk" \
            | tee upload.json
        '''
      }
    }

    stage('Trigger') {
      steps {
        sh '''
          VERSION=$(jq -r .details.version_name upload.json)
          curl -sf -X POST "${DRIZZ_BASE_URL}/testplan/run" \
            -H "x-api-key: ${DRIZZ_API_KEY}" \
            -H "Content-Type: application/json" \
            -d "{\\"test_plan_id\\":\\"${TEST_PLAN_ID}\\",\\"apks\\":{\\"${PACKAGE_NAME}\\":\\"${VERSION}\\"}}" \
            | tee trigger.json
        '''
      }
    }

    // BLOCKED — a "Wait for result" stage goes here once a run-status
    // endpoint exists. There is nothing to poll today.
  }

  post {
    always {
      archiveArtifacts artifacts: 'upload.json,trigger.json', allowEmptyArchive: true
      echo 'Drizz run triggered. Open the report in the Drizz web app for the outcome.'
    }
  }
}

Secrets

Value	Where it belongs
Client ID, client secret, audience, auth host, base URL	CI secret store. Never committed
Access token	Run-scoped variable, masked in logs — ::add-mask:: in GitHub Actions

Common mistakes

What you did	What happens
Treated a green trigger step as a green test run	It only means the run started
Put the Drizz step in front of a release gate	The gate lets everything through
Uploaded the build on every commit	Slow pipelines, and 409s on unchanged versions
Cached the token between pipeline runs	It expires after 24 hours
Echoed the token in a build log	Anyone with log access can trigger your runs
Looped single triggers over 30 plans	HTTP 429. Use the batch endpoint

Next

• API overview — the base URL and the auth model

• Trigger a run — single and batch triggers

• Errors & limits — rate limits and retries

---

Last updated: 6 August 2026