Continuous integration

CI credentials

Team owners and admins can create read-only CI tokens through the account devices API with kind: ci. The token is shown once. The current Devices screen creates device tokens; hosted CI token provisioning is coming soon. Store the CI token in your CI provider's secret store, restrict access, and never commit it or print it in logs.

On an isolated job runner with the CLI available, provide the existing token as a private secret file and read it from standard input. For npm, for example:

scrutyn login --token-stdin < /run/secrets/registry-token
scrutyn setup npm --user --apply

Replace the file path with your CI provider's secret-file path. Login validates and saves the token in the runner's credential store; use an isolated, disposable home and remove it after the job. Replacing a previously saved token can revoke the previous device. Setup uses the saved token and refuses an active SCRUTYN_TOKEN override. Hosted CLI distribution is coming soon.

Configure each package manager's registry and credentials for the job, and verify that alternate registries, extra indexes, lockfile URLs and direct downloads do not bypass it. CI tokens are read-only and cannot perform administrative actions or request bypass grants.