Deploy from GitHub Actions or GitLab CI without putting a static secret in CI — and get a signed receipt of every deploy you can show an auditor.
No long-lived deploy key or password stored in CI. The CI job proves its identity with a short-lived token; Ankayma verifies it and hands out ephemeral, deploy-only access for that one run. A leaked workflow on a random branch can't reach production, because a deploy rule pins exactly which repo, on which branch or environment, may reach which target.
On Deploy Rules, create a rule with the repo (owner/name), the issuer (GitHub or GitLab), and exactly one of a branch ref or an environment — optionally the node the deploy may reach. That's the whole policy.
Every run ends in a signed receipt anchored in a tamper-evident ledger — which run, which repo, which service it touched, with no static secret anywhere in the chain. Anyone holding the run id can re-verify it against the live ledger: the proof is evidence you hold, not the word "secretless" alone.
Ship to production without the biggest CI liability — a stored secret that leaks — and hand your security or compliance reviewer a receipt instead of a promise.