Stop paying CI to test the same code twice

Your CI bill pays for the same work twice

Agents push every change to staging, then the same change to production. The files are identical, but the production pipeline can't tell: it installs, tests and builds from scratch.

• Every change, two full runs

  With staging and production, one pipeline run in two re-validates files that already passed.

• Cheaper minutes don't fix it

  Lower runner prices cut the price of a minute, not the number of minutes your agents trigger.

• More pushes, more waste

  Every agent push, re-push and rebase pays for its duplicate run again.

Build and validate once. Promote the exact artifact.

hushrun is one static binary that runs inside the CI you already have. It adds three things to your pipelines:

Already running in production, on our own CI

hushrun generalizes ci-promote, a bash tool that does the same for one GitHub repository. ci-promote runs in production on Kobranzapp/back, the backend of our own company, Kobranzapp.

Since June, every commit to main on Kobranzapp/back had files that staging had already tested and built. Its production runs skip the tests and the build, and copy staging's exact image.

That's one team, and it's ours. Pilots are how we find out whether yours looks the same.

version: 1
repository: github.com/acme/api

checks:
  lint:        { kind: source, run: pnpm lint }
  unit:        { kind: source, run: pnpm test, timeout: 20m }
  integration: { kind: source, run: pnpm test:integration, timeout: 30m }

artifacts:
  image:
    type: oci
    locations:
      staging: us-docker.pkg.dev/acme-staging/api/server
      production: us-docker.pkg.dev/acme-prod/api/server

stages:
  staging:
    branch: develop
    require: [lint, unit, integration]
  production:
    branch: main
    after: staging
    require: [lint, unit, integration]

- id: plan
  run: hushrun plan --stage production --start

# later jobs carry the plan out instead of deciding again
deploy:
  if: contains(fromJSON('["promote","refresh","full"]'),
               needs.plan.outputs.mode)

Questions teams ask first

• Is it safe to skip tests in production?

  hushrun skips a check only when it has valid evidence for exactly the same files: a pass, signed by a member's machine or your repository's CI (or only CI, for a stage set that way in the dashboard), younger than the check's max_age. A repository can also have CI reuse only CI's results. Deployment checks, such as smoke tests against production, still run after the deploy. Approvals are never waived, and you can force a full run.

• What about environment config baked into builds?
• What does it cost?
• How is this different from build caches or path filters?
• What does the hosted plan see?
• What happens after I ask for a pilot?