# Automating Cerbos Policy deployments with CircleCI

This guide will help you set up a CI/CD pipeline in CircleCI to automatically upload your Cerbos policies to a Cerbos Hub store whenever you push changes to the `main` branch of your Git repository.

## Prerequisites

- A CircleCI account, linked to your GitHub or Bitbucket account.
- Your repository "set up" as a project in CircleCI.
- The ID of your Cerbos Hub store, which you can find in the store section of the Cerbos Hub.
- Your `CERBOS_HUB_CLIENT_ID` and `CERBOS_HUB_CLIENT_SECRET` values generated in the **Client credentials** section of the Cerbos Hub store. Make sure to select the `Read & Write` option when creating the credentials to allow uploading policies.

## Step 1: Create the Config File

1. In your repository, create a directory named `.circleci`.
2. Inside `.circleci`, create a file named `config.yml`.
3. Copy and paste the following code into it.
4. Replace `[STORE_ID]` with the ID of your Cerbos Hub store. You can find this in the Cerbos Hub UI under the store settings.

```yaml
   # .circleci/config.yml
   version: 2.1

jobs:
     upload-policies:
       docker:
         - image: cimg/base:2024.01
       steps:
         - checkout
         - setup_remote_docker:
             version: 20.10.24
         - run:
             name: Upload Policies
             command: |
               docker run --rm \
                 -e CERBOS_HUB_STORE_ID="[STORE_ID]" \
                 -e CERBOS_HUB_CLIENT_ID=$CERBOS_HUB_CLIENT_ID \
                 -e CERBOS_HUB_CLIENT_SECRET=$CERBOS_HUB_CLIENT_SECRET \
                 -v "$(pwd)":/app \
                 ghcr.io/cerbos/cerbosctl:latest \
                 hub store replace-files /app --message="Policy upload from CircleCI"

workflows:
     build-and-upload:
       jobs:
         - upload-policies:
             filters:
               branches:
                 only: main
   ```

## Step 2: Add Your Secrets

1. Go to the CircleCI dashboard and select your project.
2. Click **Project Settings** in the upper right.
3. In the sidebar, click **Environment Variables**.
4. Click **Add Environment Variable**.
5. Enter `CERBOS_HUB_CLIENT_ID` as the _Name_ and paste your client ID as the _Value_. Click **Add Environment Variable**.
6. Repeat for `CERBOS_HUB_CLIENT_SECRET`.

## Step 3: Commit and Push

1. Commit the `.circleci/config.yml` file.
2. Push your changes to the `main` branch.

## Step 4: Verify the Run

1. Go to your project's dashboard in CircleCI.
2. You will see a new workflow running. Click on it to see the status of the `upload-policies` job.