RB · Recipient + Portal Build
The Portal decrypts and builds. GitHub is reduced to a trigger and a checkmark.
Every developer has their own keypair, and so does the Portal. GitHub asks for a build and receives a status — it never decrypts anything, because it never builds anything.
The strongest isolation of the eight. GitHub sees one commit SHA go out and one status come back.
1 · Create the token
Do this first. sgit init uploads the secrets your workflow reads, and without
a token it sets up everything except the half that makes builds run.
GitHub → Settings → Developer settings → Fine-grained tokens → Generate new
| Repository access | Only select repositories → this one |
| Contents | Read and write — so you can push |
| Secrets | Read and write — so init can upload them |
Metadata: read is added for you.
export GITHUB_PAT=github_pat_…GH_TOKEN and GITHUB_TOKEN work too. If none is set and you are at a
terminal, init offers to take it and stores it per project.
2 · Seal the repository
sgit rbrb is the shorthand for this pair, and takes every flag init takes.
Spelled out, it is:
sgit init --mode recipient --ci-mode portal-buildOn your disk:
admin.key # adds and removes recipients
identity.age # yoursEvery key is outside the repository, at 0600. A key in the working tree is
one git add -A from being published.
3 · Check GitHub is ready
sgit init uploaded CODESEAL_TOKEN as it went — that is what the token in step 1
was for. Confirm it landed:
sgit ci verifymylife-inc/demo is ready to build.
It decrypts nothing; it authorises asking the Portal for a build.
4 · Protect something
sgit add-sensitive src/private
sgit encrypt5 · The everyday loop
sgit add -s src/private/payment.rs
sgit commit -- -m "protect payments"
sgit push origin mainPush, and the workflow posts the commit SHA to the Portal. A worker clones at
that SHA into a fresh workspace, decrypts with the repository's admin key,
deletes the keys before build.sh starts, builds, uploads the artefact, and
scrubs the workspace. The workflow polls until it reaches a terminal state.
What you end up with
| On GitHub | ciphertext, and a token that only asks for builds |
| In the Portal | the keys, and the only machine that sees plaintext |
| Adding a teammate | a rewrap |
| To start a build | nothing — GitHub triggers, the Portal builds |