Every build, reproducible and signed.
Girder builds in a sealed sandbox, records the exact inputs that produced each artifact, and signs the result. Two builds of the same commit are the same bytes — on your laptop and in CI.
Free for 14 days · No card required · One config file
girder.app/builds
Recent builds
1 runningCache hit rate
84.2%
Non-reproducible
0.3%
2 targets marked, both known
Compute / artifact
$0.021
Down from $0.058 in June
Platform teams already building on Girder
- Northwind
- Everline
- Blackford
- Quanta
- Riverstone
- Palladio
The gap
Your CI is green and you still can't answer the question.
Which commit produced the binary in production, and would building it again give you the same bytes? Most pipelines cannot say.
Where it breaks today
Builds depend on the machine
A tool version drifts on one runner, a system library differs on a laptop, and the same commit produces two different artifacts. The failure surfaces weeks later as a bug nobody can reproduce.
What Girder does instead
Hermetic by construction
Every build runs in a sandbox with a declared closure: no network, no ambient toolchain, no host filesystem. Same inputs, same output, on any machine.
Where it breaks today
Nobody can trace an artifact back
Six weeks after a release, tracing a container back to its commit, its dependencies and the person who approved it means reading logs — if the logs are still there.
What Girder does instead
Provenance on every artifact
A signed attestation records the source revision, the full input closure, the builder identity and the approvals. Verify it at deploy time or in an audit.
Where it breaks today
Rollback is another deploy
Reverting means re-running the pipeline and hoping it produces what it produced last Tuesday, at the worst possible moment to be finding out.
What Girder does instead
Rollback is a pointer move
Every artifact is content-addressed and kept. Rolling back re-points the environment at bytes that already exist and have already been verified.
The dashboard
Open any build and read its whole closure.
Which revision, which toolchain, which dependencies at which hashes, what it produced and who signed it — every input on the record, down to the byte.
girder.app/builds/BLD-8841
api-gateway
BLD-8841Signed · 0:31- Resolve the closure0:02
412 inputs · 0 undeclared
- Restore from cache0:03
388/412 hit · 24 to build
- Policy check0:00
licences ok · no blocked CVE class
- Artifact0:21
sha256:4f1c… — matches last build
- Sign the attestation0:03
prism.keys.sign · slsa-v1
- Push to the registry0:02
harbor.images.put
- Inputs
- 412
- Cache hits
- 388
- Compute
- $0.044
- Policy
- supply-chain@v9
01
Input-level provenance
Every file the build could read, hashed and recorded. Nothing enters a sandbox unnamed.
02
Rebuild and compare
Re-run a past build on today's runners and diff the output bytes, not the logs.
03
Cost per artifact
Compute attributed to the thing it produced, with cache hits shown as the saving they are.
Capabilities
Built for the team that gets paged.
Everything below ships on every plan. The Enterprise tier adds controls, not features.
Supply-chain policy
Declare what may enter a build and what may reach production, in one file. Girder compiles it into checks that run before the artifact is signed.
Compiled to
- Allowed registries
- Licence rules
- Required attestations
- Blocked CVE classes
Approvals on promotion
Builds land in staging on their own. Anything crossing into production waits for the reviewers the policy names.
Reproducible replay
Re-run any historical build against a new toolchain and diff the resulting artifact, before you cut the release.
Remote cache and execution
Share one content-addressed cache across CI and every laptop. Cold builds become warm ones without changing a line.
Runs where you want
- Hosted runners
- Self-hosted
- In your VPC
- Per-repo routing
Sixty native connectors
Registries, identity providers, incident tooling and warehouses. Anything missing takes an afternoon over the SDK.
Reads and writes
- Prism
- Harbor
- Relay
- +57 more
Enterprise controls
SAML SSO, SCIM provisioning, regional build residency, customer-managed signing keys and a signed DPA.
Getting started
Building by lunchtime, not next sprint.
No pipeline rewrite. No migration of your existing CI in one go.
- 1
Point it at a repo
Girder reads your existing build files and writes a first closure. One service, not the monorepo.
- 2
Seal the inputs
It reports what the build reached for that you did not declare. Fixing that list is the whole migration.
- 3
Run it beside CI
Both pipelines build every commit for a week. Compare artifact hashes and wall-clock time before you switch anything.
- 4
Cut over one service
Promote when the hashes match, and point back at your old pipeline just as fast if they stop.
Connected
It plugs into the pipeline you already have.
Sixty native connectors, a typed SDK for everything else, and no per-connector pricing.
In production
The numbers our customers report back.
12.4M
Builds each month
Across 3,200 repositories
84%
Cache hit rate
Median, after the first week
31 s
Median build, warm cache
Down from 6m 40s
99.98%
Builder uptime
Trailing twelve months
Proof
Teams that stopped debugging their pipeline.
We had a flake that only reproduced on one runner class. Girder made the input list explicit and the flake turned out to be a system library nobody had declared for four years. It took an afternoon to find and ten minutes to fix.
4-year-old flake closed
The attestation is what got us through the audit. Every artifact in production could name its commit, its dependencies and the person who approved the promotion, without anyone opening a log.
Audit closed in one pass
Our build was eleven minutes and a coin flip. It is now thirty seconds and deterministic, and the part I actually care about is the second half of that sentence.
11 min to 31 s
Pricing
Priced on build minutes, not on seats you're afraid to add.
Invite the whole engineering org on every plan. Cache hits are never billed.
Starter
For a first team sealing one service.
You save $120 a year
Start building- Unlimited teammates
- 2,000 build minutes each month
- 10 GB of remote cache
- Provenance on every artifact
- Community support
Growth
Most teams start hereFor platform teams running the whole pipeline here.
You save $480 a year
Start building- Everything in Starter
- 40,000 build minutes each month
- 1 TB of remote cache and execution
- Promotion approvals and supply-chain policy
- Self-hosted runners
- Priority support, 4-hour response
Enterprise
For regulated teams with their own security bar.
- Everything in Growth
- Unlimited minutes, committed pricing
- SAML SSO and SCIM provisioning
- Regional build residency and customer-managed signing keys
- Private runner fleet in your VPC
- Named engineer and 99.9% SLA
All prices in USD. Overage billed at $0.006 per build minute — never a surprise invoice.
Questions
The things people ask before signing up.
Still unsure? An engineer answers, not a bot.
Talk to a humanNo. Girder wraps your existing build and reports what it reached for that was not declared — the undeclared list is the migration, and it is usually a handful of system tools. Teams typically seal their first service in a day and the rest incrementally, with both pipelines running side by side for as long as they want.
Seal one service and see.
Run Girder beside your pipeline for a week and compare the artifact hashes. If they don't match, you have learned something worth knowing either way.
Free for 14 days · No card required