Home / Articles / sgit in a CI pipeline / Versions / v1.2.0
sgit in a CI pipeline: what changed in v1.2.0
From v1.1.0 (2026-10-19, d303ce0f1) to v1.2.0 (2026-10-27, db67c5ce1), paragraph by paragraph.
0 paragraphs added, 0 removed, 3 changed in place, 64 unchanged. About 0 words added and 147 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
2 unchanged paragraphs
!shot vc-pipeline.webp | images/ | A pipeline whose stages talk through a vault.vault, Eachwith each job clones only the folders it needs, withholding only the key it needs: build writes with the vault key, test shards append to write-only inboxes, the summary reads the lane, release and deploy read with the read key and their own key pairs, and anyone outside GitHub can clone the results with a read key. What leaves a runner is ciphertext.needs. | architecture
27 unchanged paragraphs, under In short {#in-short}, Why CI data is awkward {#why}, What was tested {#tested}…
!shot vc-keys.webp | images/ | Which job holds which key. Build and the summary hold the vault key, release, deploy and outside readers the read key, each test shard one append token, the summary the lane's enum key, and what the jobs that sign or decrypt their own key pair. The server access token opensdoes aand private server's door for everyone; it isdoes not a vault permission.do. | comparison
16 unchanged paragraphs, under Append lanes for shards {#lanes}, A key pair for every job {#pki}, No hosted server {#no-server}
!shot vc-noserver.webp | images/ | No hosted server.server: Thethe vault server runs as a container inside the jobjob, withand its storageciphertext in a folder; the folder holds only ciphertext, so it can beis saved tobetween the Actions cache, an artifact, a release asset or a git branch, and the next run restores it and clones with its full history. Reading needs no server at all; pushing needs the server's API, which the sidecar provides.runs. | architecture
19 unchanged paragraphs, under A workflow sketch {#workflow}, What this does not claim {#limits}, Where this comes from {#sources}