Connect a Platform

This is the short path into an identity for a pipeline, under Machine Identities then Connect a Platform. Pick the platform your job runs on, answer the two or three questions that identify the workload, and the console does the rest. It creates the identity with its trust already written, then prints the snippet. No secret is stored, and none of it counts against your plan.

The catalog

Thirty-two platforms mint a signed token that names the workload. They sit in one flat grid, in a fixed order, with no groups and no search box. Each card names the platform, says how many identities trust it today, and opens the form that identifies your workload. Each form asks only for the values that identify it and builds the issuer and the subject from your answers.

The grid runs in this order: GitHub Actions, GitLab CI, CircleCI, Buildkite, Bitbucket Pipelines, Kubernetes, Jenkins, GitHub Enterprise Server, Forgejo Actions, Bitrise, HCP Terraform, Google Kubernetes Engine, Amazon EKS, Azure Kubernetes Service, Oracle Container Engine for Kubernetes, SPIFFE and SPIRE, Vercel, Deno Deploy, Fly.io, Ona, Auth0, Keycloak, HashiCorp Vault, HashiCorp Nomad, Teleport Workload Identity, TeamCity, RWX, Okta, Scalr, Devin, GitHub Enterprise Cloud (data residency), authentik.

Bare VPS is a thirty-third card for a host that can prove nothing else, and it appears only when this deployment holds a keypair challenge secret. Without one, nothing enrolled there could ever authenticate, so the card is absent rather than dead.

GitHub Actions has its own dialog

GitHub's subject is read from the API rather than typed, so that card asks you to pick a repository from a list instead of filling a form.

That card carries its button only when GitHub Connect is configured on this deployment. Without it the card still describes the platform and offers nothing, because there is nothing safe to offer.

The audience is your workspace id

Every token a trust accepts has to name your workspace as its audience. Ask for that audience and no other. A token requested for two audiences fails every exchange, because penv refuses a list rather than picking one from it.

Two issuers get a warning under the subject field. Google's subject names the service account, and Azure's names the managed identity, so any number of hosts running as it will match one trust.

Bare VPS

The Bare VPS dialog covers a host with no signed metadata and no secure element. The host generates an Ed25519 key, penv keeps the public half, and every login advances a counter both sides hold. A copied key works once and then locks both out.

The snippet at the end

Every snippet keeps the platform token inside one step and one process. A token that reaches a step output or the job environment is a token every later step and every debug log can read.

Each snippet finishes with penv pull, which writes a file. penv run is what the docs teach, because it hands the values to one child process and writes nothing to disk. Connect your CI has the wrapped step.

What each action needs

Creating an identity from All Identities asks you to confirm it is you. Connecting a platform here does not, because a trust hands nothing over.

Next: integrations.