{ "slug": "safe/ci-cd", "title": "Safe CI/CD", "description": "Resolve Safe references in CI/CD jobs without leaking values into scripts, logs, or process metadata.", "url": "https://cuitty.com/docs/safe/ci-cd", "markdown_url": "https://cuitty.com/docs/safe/ci-cd.md", "json_url": "https://cuitty.com/docs/safe/ci-cd.json", "frontmatter": { "title": "Safe CI/CD", "description": "Resolve Safe references in CI/CD jobs without leaking values into scripts, logs, or process metadata.", "order": 6, "section": "Safe", "updatedAt": "2026-06-09" }, "headings": [ { "depth": 1, "slug": "safe-cicd", "text": "Safe CI/CD" }, { "depth": 2, "slug": "package-script-pattern", "text": "Package script pattern" }, { "depth": 2, "slug": "job-flow", "text": "Job flow" }, { "depth": 2, "slug": "service-accounts", "text": "Service accounts" }, { "depth": 2, "slug": "cuitty-code-and-registry", "text": "Cuitty Code and Registry" } ], "body_markdown": "# Safe CI/CD\n\nCI/CD should use explicit Safe references only. Resolve values at the job boundary, inject them into the child process, and install redaction rules before the process starts.\n\n## Package script pattern\n\n```jsonc\n{\n \"scripts\": {\n \"deploy\": \"cuitty-safe run --scope acme/prod -- bun run deploy:raw\",\n \"registry:publish\": \"cuitty-safe run --scope acme/registry -- bun publish\"\n },\n \"cuittySafe\": {\n \"env\": {\n \"DATABASE_URL\": \"acme/prod/database-url\",\n \"REGISTRY_TOKEN\": \"acme/registry/publish-token\"\n }\n }\n}\n```\n\n## Job flow\n\n1. Load job configuration.\n2. Build the Safe reference set.\n3. Request a Safe run plan.\n4. Resolve values from the configured provider.\n5. Inject resolved env only into the child process.\n6. Install redaction rules for logs.\n7. Emit audit metadata without values.\n\n## Service accounts\n\nFor 1Password-backed production CI, use a least-privilege service account scoped to the required vault and fields. Cuitty Safe should read the token from the CI provider's secret store, commonly exposed as `OP_SERVICE_ACCOUNT_TOKEN`.\n\n```bash\ncuitty-safe connector 1password test --scope acme/prod\ncuitty-safe run --scope acme/prod -- bun run deploy:raw\n```\n\n## Cuitty Code and Registry\n\nCuitty Code can resolve app manifest env, runner env, mirror credentials, webhook signing secrets, OAuth app credentials, deployment keys, Airflow tokens, and Dagger tokens.\n\nCuitty Registry can resolve npm publish tokens, Cargo registry tokens, PyPI upload tokens, OCI credentials, artifact storage DSNs, signing keys, and provenance keys.\n\nDo not resolve Safe refs inside tight package download paths unless explicitly configured.", "body_html": "

Safe CI/CD

\n

CI/CD should use explicit Safe references only. Resolve values at the job boundary, inject them into the child process, and install redaction rules before the process starts.

\n

Package script pattern

\n
{\n  \"scripts\": {\n    \"deploy\": \"cuitty-safe run --scope acme/prod -- bun run deploy:raw\",\n    \"registry:publish\": \"cuitty-safe run --scope acme/registry -- bun publish\"\n  },\n  \"cuittySafe\": {\n    \"env\": {\n      \"DATABASE_URL\": \"acme/prod/database-url\",\n      \"REGISTRY_TOKEN\": \"acme/registry/publish-token\"\n    }\n  }\n}
\n

Job flow

\n
    \n
  1. Load job configuration.
    2. \n
  2. Build the Safe reference set.
    3. \n
  3. Request a Safe run plan.
    4. \n
  4. Resolve values from the configured provider.
    5. \n
  5. Inject resolved env only into the child process.
    6. \n
  6. Install redaction rules for logs.
    7. \n
  7. Emit audit metadata without values.
    8. \n
\n

Service accounts

\n

For 1Password-backed production CI, use a least-privilege service account scoped to the required vault and fields. Cuitty Safe should read the token from the CI provider’s secret store, commonly exposed as OP_SERVICE_ACCOUNT_TOKEN.

\n
cuitty-safe connector 1password test --scope acme/prod\ncuitty-safe run --scope acme/prod -- bun run deploy:raw
\n

Cuitty Code and Registry

\n

Cuitty Code can resolve app manifest env, runner env, mirror credentials, webhook signing secrets, OAuth app credentials, deployment keys, Airflow tokens, and Dagger tokens.

\n

Cuitty Registry can resolve npm publish tokens, Cargo registry tokens, PyPI upload tokens, OCI credentials, artifact storage DSNs, signing keys, and provenance keys.

\n

Do not resolve Safe refs inside tight package download paths unless explicitly configured.

", "links_out": [] }