CI/CD that runs on your infrastructure — we never see your source or secrets.

Author in typed TypeScript

Real code with types and autocomplete — not YAML. Loops, conditionals, and reuse with the full language.

Test locally and remotely

Run on your real agents with kici run remote before you push — or run on your own machine with kici run --local and dry-run with kici preview.

Sovereign execution, hosted observability

Jobs run on your own infrastructure — we never see your source, secrets, or build output. The hosted dashboard gives your team full visibility and management of every run.

// .kici/workflows/ci.ts — code, not config
import { workflow, job, step, rule, pr, push } from '@kici-dev/sdk';
import { readdir } from 'node:fs/promises';

const install = step('install', async ({ $ }) => {
  await $`pnpm install --frozen-lockfile`;
});

export default workflow('ci', {
  on: [pr(), push({ branches: 'main' })],
  jobs: [
    job('test', {
      runsOn: 'kici:os:linux',
      // discover packages at runtime — a real loop, not a hardcoded list
      matrix: async () => {
        const entries = await readdir('packages', { withFileTypes: true });
        return entries.filter((e) => e.isDirectory()).map((e) => e.name);
      },
      steps: [install, step('test', async ({ $, matrix }) => {
        await $`pnpm --filter ${matrix!.value} test`;
      })],
    }),
    job('deploy', {
      runsOn: 'kici:os:linux',
      needs: ['test'],
      rules: [rule('only on main', ({ event }) =>
        event.type === 'push' && event.payload?.ref === 'refs/heads/main')],
      // each job runs on a fresh clone, so deploy installs too — reuse the step
      steps: [install, step('deploy', async ({ $ }) => {
        await $`pnpm run deploy`;
      })],
    }),
  ],
});