Sealrepo
Sign inStart free
Automation · Preview

Unlock from a CI pipeline, safely

A CI token is a short-lived bearer string (prefixed sct_…) that authenticates only your build runners — never your humans. They're scoped, time-boxed, and revocable from the dashboard the moment a build server is compromised.

Preview — CI consumer endpoint ships in 1.5
CI tokens can be created, listed, and revoked in your dashboard today and are useful for inventory & rotation right now. However, the build-runner side of the integration (the sealrepo unlock --ci command consuming the token) ships in sealrepo 1.5. The YAML example below is provided for review; running it against [email protected] will fall back to the regular user-token unlock path.
Why not just use my own CLI token?
Your CLI login token can do everything in your account. A CI token can only read or unlock one project, expires on a deadline you set (12h to 90d), and only accepts the actions you scope it to. Worst case if your CI logs leak, the blast radius is one project for a few days — not your whole account forever.

  1. Create a token on the dashboard

    Project page → CI tokens tab → New token.

    sealrepo.dev/app/projects/acme-billing/ci

    Create CI token

    A bearer token for one specific pipeline.

    Label
    github-actions-prod
    Expires in
    30 days
    Scope
    unlockread
    Create token
    Save the token NOW
    The full token is shown once. We only store a hash — if you lose it, you have to revoke and create a new one. Paste it straight into your secret manager (GitHub → Settings → Secrets, GitLab → CI/CD → Variables, etc.).

  2. Use it from a build pipeline (1.5 preview)

    In sealrepo 1.5 the token will go in the SEALREPO_TOKEN environment variable. The CLI will pick it up automatically — no sealrepo login required, no interactive passphrase prompt either.

    The pipeline integration below is the planned shape for 1.5 and is shown here so you can wire up secret management ahead of time. Against [email protected], sealrepo unlock --ci currently logs a deprecation notice and falls through to the regular login flow.

    Show planned GitHub Actions example (1.5 preview)

    GitHub Actions

    .github/workflows/build.yml
    # Minimal workflow that builds your sealed repo
    name: build
    on: [push]
    jobs:
    build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - run: npm install -g sealrepo
    - run: sealrepo unlock --ci
    env:
    SEALREPO_TOKEN: ${{ secrets.SEALREPO_TOKEN }}
    SEALREPO_PASSPHRASE: ${{ secrets.SEALREPO_PASSPHRASE }}
    - run: npm ci && npm run build

    What the 1.5 build log will show

    GitHub Actions runner
    $sealrepo unlock --ci
    Authenticating with CI token (sct_4f9…) ⠋
    ✓token valid · project acme-billing · scope unlock · expires in 27d
    decrypting (137) vendor/_01/_8a3f9c1e2d4b ⠋
    ✓unlocked 137 files in 412ms
    $npm ci && npm run build
    ...
    GitLab CI, CircleCI, Buildkite, Jenkins…
    Same pattern. Anything that sets environment variables works.SEALREPO_TOKEN + the passphrase (also from a secret) and sealrepo unlock --ci.

  3. Watch when it was last used, revoke when it's not yours anymore

    The CI tokens tab shows every token, when it was created, when it expires, and the timestamp of its last use. If you see a token that shouldn't be used anymore — click Revoke:

    sealrepo.dev/app/projects/acme-billing/ci
    Active CI tokens
    github-actions-prod
    unlocklast used 3 min agoexpires in 27 days
    staging-builds
    readlast used 2 days agoexpires in 12 days

    Revocation is instant. The next CI build that runs gets a 401 and fails loudly:

    Post-revoke CI build
    $sealrepo unlock --ci
    ✗CI token sct_4f9… was revoked.
    ✗Generate a new one at sealrepo.dev/app/projects/acme-billing/ci
    Exit code: 1

  4. Picking the right scope

    readLists files in the vault and downloads ciphertext only.
    When to use: Auditing, manifest checks, dependency scans that don't need source.
    unlockEverything read can do, plus decrypts files with the passphrase.
    When to use: Real builds that compile or test your code.
Next
Set up cloud key escrow
→