# sgit in a CI pipeline: what changed in v1.2.0, sgit.ai > The changes to the article "sgit in a CI pipeline" in v1.2.0, paragraph by paragraph. *Source: · sgit.ai v0.7.87 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Articles](../../index.md) / [sgit in a CI pipeline](../../sgit-in-a-ci-pipeline.md) / [Versions](../sgit-in-a-ci-pipeline.md) / v1.2.0 # sgit in a CI pipeline: what changed in v1.2.0 From v1.1.0 (2026-10-19, `d303ce0f1`) to v1.2.0 (2026-10-27, `db67c5ce1`), paragraph by paragraph. 0 paragraphs added, 0 removed, 3 changed in place, 64 unchanged. About 0 words added and 147 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names. [← v1.1.0](v1.1.0.md) · [all versions](../sgit-in-a-ci-pipeline.md) 2 unchanged paragraphs !shot vc-pipeline.webp | images/ | A pipeline whose stages talk through a vault.vault,Eachwith each job clones only the folders it needs, withholding only the key it needs: build writes with the vault key, test shards append to write-only inboxes, the summary reads the lane, release and deploy read with the read key and their own key pairs, and anyone outside GitHub can clone the results with a read key. What leaves a runner is ciphertext.needs. | architecture 27 unchanged paragraphs, under In short {#in-short}, Why CI data is awkward {#why}, What was tested {#tested}… !shot vc-keys.webp | images/ | Which job holds which key. Build and the summary hold the vault key, release, deploy and outside readers the read key, each test shard one append token, the summary the lane's enum key, and what the jobs that sign or decrypt their own key pair. The server access token opensdoesaandprivate server's door for everyone; it isdoes not a vault permission.do. | comparison 16 unchanged paragraphs, under Append lanes for shards {#lanes}, A key pair for every job {#pki}, No hosted server {#no-server} !shot vc-noserver.webp | images/ | No hosted server.server:Thethe vault server runs as a container inside the jobjob,withand its storageciphertextin a folder; the folder holds only ciphertext, so it can beis saved tobetweenthe Actions cache, an artifact, a release asset or a git branch, and the next run restores it and clones with its full history. Reading needs no server at all; pushing needs the server's API, which the sidecar provides.runs. | architecture 19 unchanged paragraphs, under A workflow sketch {#workflow}, What this does not claim {#limits}, Where this comes from {#sources} [← v1.1.0](v1.1.0.md) · [all versions](../sgit-in-a-ci-pipeline.md) --- *[Site index for agents](../../../llms.txt) · [HTML version](https://newsroom.sgit.ai/articles/versions/sgit-in-a-ci-pipeline/v1.2.0.html)*