Push to green in nine seconds.

The workflow file you already have, run in an isolated sandbox per run, one check per job reported at the head. It is the CI half of the evidence.

Request an invite

ci #79 · attempt 7.1

Three jobs, one page.

Every job as a card in the order the workflow says, the log of each step underneath, and the artifact the build uploaded. This run is the CI half of the evidence for attempt 7.1.

CI run 79 for attempt 7.1: typecheck, test and build green in 43 seconds, the typecheck log open, one artifact dist.zip — ci #79 at 97cbe5f: three jobs green, first check 35 s after the push, dist.zip kept by digest.

The file you already have

Workflows live in .sigbound/workflows/ or .github/workflows/, in the GitHub Actions format. Jobs, steps, needs, matrices, uses, secrets and environments read the same way.

# .sigbound/workflows/ci.yml, or the .github/workflows/ci.yml you already have
name: ci
on: [push]
jobs:
  typecheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - run: npm ci
      - run: npm run typecheck
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - run: npm ci
      - run: npm test
  build:
    runs-on: ubuntu-latest
    needs: [typecheck, test]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - run: npm ci
      - run: npm run build
      - uses: actions/upload-artifact@v4
        with: { name: dist, path: dist }

Where it runs

Isolation first, then speed. From a push to a green three-job workflow with the sandboxes already warm is 9 seconds; the measurement is on the speed page.

One sandbox per run

A run that fits gets its own microVM, started for it and gone after it. Nothing from one run is on the disk of the next.

Warm start

The repository cache is warmed before the push lands, so the first check starts in seconds, not after a clone.

One check per job

Each job reports one check at the head, in the order needs says. Three jobs, three checks, on the evidence page.

Logs and artifacts

Logs by step, with runner lines folded away. What a workflow uploads is kept by digest, and the download is the exact bytes.

How the 9 seconds was measured

Workflows

Every run of every workflow.

One workflow definition on main, thirty runs in the evidence window, each one tied to the attempt and the head it ran for. A head that was already verified reuses the earlier evidence instead of running again.

Runs

CI, reads and verify runs, one ledger.

Every run the repository can replay as evidence in one list: the workflow runs, Sigbound AI's reads, and the gate's own verify and land runs. Filter by state or by goal.

The Runs tab of snake-sigbound-2: land, Sigbound AI, ci.yml and verify runs for attempt 7.1, each succeeded, with its duration — All runs for attempt 7.1 at 97cbe5f: the land run, the read, ci.yml, and the verify run.

Secrets and environments

A secret is written once and never shown again; it reaches a job only inside its scope, masked in the log. An environment can name reviewers, hold for a timer, and accept only some branches.

Repository secrets settings: add or replace a secret, written once and never shown; variables below it — Secrets for a repository: written once, never shown again, masked in the run's log. A space secret of the same name is shadowed by the repository's.

Environments settings: declare an environment with a name, a wait timer, the branches it deploys from, and its reviewers — Declaring an environment: reviewers, a wait timer, and the refs it may deploy from. The requester can never be the reviewer.

Read the rest

CI in the docs

Workflows, sandboxes, artifacts, and what the run page shows. CI

Where a green check ends up

The checks at the head are half of the evidence a person approves; the signed merge record quotes them. How it works