Features
Secure by default
Short-lived credentials through OIDC, protected environments with required reviewers, resolved permissions, and secrets that are never written anywhere.
No long-lived keys, anywhere
permissions: id-token: write works as it does on GitHub: the job receives a short-lived identity token
and exchanges it for cloud credentials that expire with the job. No access key in a repository secret, no
rotation calendar, nothing to leak.
permissions:
id-token: write
contents: read
steps:
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789012:role/deploy
aws-region: eu-west-1
Environments that wait for a person
A job that names a protected environment waits for the rules an operator set: required reviewers (users or teams), a wait timer, a branch policy. The run screen says who is being waited on. Deployments are recorded whether or not anything gated them.
Permissions, resolved
Every job runs with the permissions the workflow declares, resolved the way GitHub resolves them —
per-job overrides, the repository default, and read-all / write-all — so a workflow that is
least-privilege on GitHub is least-privilege here.
Secrets are write-only values
A secret is set once and read only by the job that needs it. It is never printed, never stored in a log, never captured in a snapshot, and when you reproduce a job locally the command names each secret without carrying its value.
Isolation
Every job runs in a fresh container on a fresh machine and the machine is discarded when the job ends. Nothing from one job is visible to the next, and nothing from one customer is visible to another.
Same workflows. Half the bill.
Every plan starts with a 10-day trial, without a card.