Deploy & CI/CD in depth
This is the mechanism behind Secretless deploy.
Identity, not a secret
Section titled “Identity, not a secret”Your CI job already has a verifiable identity: GitHub Actions and GitLab CI issue a short-lived OIDC token describing the run — repo, branch or environment, workflow. Ankayma verifies that token against the issuer. Nothing static is stored in CI.
The deploy rule is the policy
Section titled “The deploy rule is the policy”A deploy rule pins the exact owner/name repo, the issuer, and one of a
branch ref or an environment — optionally the target node. A leaked workflow on a random
branch matches no rule, so it reaches nothing.
Ephemeral, deploy-only access
Section titled “Ephemeral, deploy-only access”On a match, the run gets narrow, deploy-only access for that one run — no standing credential to leak or rotate.
The receipt
Section titled “The receipt”Every run ends in a signed receipt in a tamper-evident ledger: which run, which repo, which target — with no static secret in the chain. Anyone holding the run id can re-verify it against the live ledger. See Prove It.