Connect your CI

A trust maps your platform's signed token (issuer, your workspace id as audience, one exact subject) to a machine identity. We exchange that token for a credential that lasts fifteen minutes, so your CI platform holds no long-lived key. Model: machine identity.

Create the trust

Run a step (GitHub Actions)

permissions:
  id-token: write          # without this, no token is issued at all

steps:
  - name: Install penv
    run: |
      curl -fsSL https://penv.cloud/install | sh
      echo "$HOME/.penv/bin" >> "$GITHUB_PATH"

  - name: Deploy
    run: |
      T=$(curl -sS \
        -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
        "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=YOUR_WORKSPACE_ID" | jq -r .value)
      C=$(T="$T" jq -n '{token:env.T}' | curl -sS "https://penv.cloud/api/v1/auth/oidc" \
        -H 'content-type: application/json' --data-binary @- | jq -r .credential)
      PENV_TOKEN="$C" penv run -- npm run deploy

PENV_TOKEN takes precedence over the keychain. penv run reads the environment --env or PENV_ENV names, not the one the credential is bound to. The installer edits no startup file, so the $GITHUB_PATH line puts penv on PATH for later steps. Both curl calls need jq on your runner.

If your host needs a file, PENV_TOKEN="$C" penv pull writes a plain .env (penv pull, deployment). The published action and the full walkthrough: GitHub Actions guide.

Platforms

Hardening

Pinning actions by SHA, the single-audience rule, keeping tokens out of step outputs, and what a malicious step in the same job can reach: CI builds.