A new VM for every job
Every job gets its own VM, destroyed when the job ends.
Security
Protect your code and builds
Track dependencies, control network access and manage permissions, with isolated VMs for every CI job.
Track the dependencies in every repository
Track production dependencies, versions and licenses with automatically updated SBOMs.
Spot copyleft and unknown licenses. Export CycloneDX, SPDX or JSON, and review previous scans by commit.
Read the SBOM docsRepositorySBOM
Dependencies & licenses
PackageVersionLicense
Linked to its source commit
CycloneDXSPDXJSON
Outbound rules a job can’t switch off
Control where builds connect with organization and repository rules enforced outside the VM. See allowed and blocked connections for each job.
Required service connections stay allowed, including GitHub Actions, Avrea caches and Azure Blob Storage.
Explore the egress firewallEgress firewall
registry.npmjs.orgAllowregistry.example.comAllow- Other destinationsDeny
Give your CI a known IP address
Connect to IP-restricted databases and APIs using static outbound IPs reserved for your organization.
Set up static IPsCompany sign-in
Use SAML SSO with your identity provider’s MFA and access policies.
Audit logs in your own storage
Track access and configuration changes. Export continuously to S3-compatible storage or Google Cloud Storage, with retention you control.
Built into every CI job
Repository-scoped caches
Caches are isolated by repository and encrypted in transit and at rest.
Immutable cache entries
GitHub Actions cache entries cannot be overwritten. Integrity checks verify npm and Cargo packages.
Repository access follows GitHub
Everyone, including admins, can only access repositories they can read on GitHub.
Short-lived GitHub tokens
GitHub App tokens expire automatically. Targeted operations use only the repository permissions they need.
Access and integrations
SSH access
Manage SSH access to running jobs, with repository permissions and an audit trail.
SSH controlsOrganization roles
Separate administration, billing and everyday access with organization roles.
Roles and permissionsSession limits
Automatic session expiry and sign-out across all devices.
Account securityPrivate networks
Connect runners to your private services through WireGuard, OpenVPN or Tailscale.
Network rules and limitsLogs in your own stack
Send job logs to your OpenTelemetry collector.
Observability docs