CRACI vs Buildkite

The short answer

Buildkite is a hybrid CI/CD platform. Its SaaS control plane handles orchestration, and the agents that run your jobs live on your own infrastructure, on-premises or in the cloud. Buildkite states that source code and secrets stay within your environment. It also offers fully managed hosted agents if you would rather not run your own.

CRACI is a managed GitHub Actions-compatible runner built for supply chain security. It records every external dependency a build fetches, enforces an egress policy on the build network, and produces SBOMs, signed provenance and CRA evidence from that record. Put simply: Buildkite is traditional CI with maximum infrastructure control; CRACI is security-aware CI where the runner is the evidence.

CRACI supports GitHub Actions only today, so it does not run Buildkite pipelines. A team on Buildkite would need to move a pipeline to GitHub Actions to use CRACI runners, or wait until other CI systems are supported.

What Buildkite does well

Control over compute. Because you host the agents, you choose the hardware, the operating system, the network and the region. Agents poll Buildkite's agent API over HTTPS, so you do not need to open inbound firewall ports. That model suits large monorepos, specialized hardware and organizations whose policies keep source code inside their own perimeter.

Pipeline integrity. With signed pipelines, jobs are signed on upload and agents verify the signature before running them, so an agent will not run a job whose instructions were modified after upload.

Tooling around the build. Test Engine detects and quarantines flaky tests and splits tests across parallel jobs. Package Registries can publish artifacts with SLSA provenance, which Buildkite says satisfies SLSA Build Level 1; that feature is available on Enterprise plans.

Flexible pricing. As of September 2026, Buildkite has a Free plan and a Pro plan at $30 per active user per month, with 10 self-hosted agents included on Pro and more at $3.50 per agent per month. Hosted Linux agents cost $0.004 per vCPU minute, metered to the second.

Where CRACI is different

Security evidence is part of the runner

With self-hosted agents, the build environment is yours to secure. Buildkite's own security guidance tells you to install minimal operating systems, disable inbound SSH and enforce strict network egress controls. That is a fair split of responsibility, and it means supply chain evidence depends on what your team builds around the agents.

On CRACI, that layer comes with the runner. A package-aware proxy records traffic to package sources while each job runs, across npm, PyPI, RubyGems, Cargo, Go, Nix and OCI, plus OS packages and source or download presets. Dependency evidence travels with CI caches. Every job produces a CycloneDX or SPDX SBOM with a completeness state per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded.

Egress policy without building it yourself

CRACI egress policies are default deny or default allow, with 24 built-in software-source presets, typed custom sources for npm, PyPI, apt, apk, the Go proxy, Nix, Cargo, OCI registries and Git, and explicit TLS, TCP, UDP and ICMP rules. Policies are validated before the job starts, fail closed, and send an email alert on a violation.

Provenance and monitoring

CRACI signs provenance for every artifact it builds, including OCI artifacts, using Ed25519 over SHA-512, and the API traces an artifact to its build, SBOM and network trace. CRACI does not claim a SLSA level. It aggregates vulnerabilities across builds and repositories and keeps re-evaluating monitored SBOMs.

The trade-off

CRACI is managed only. Jobs run in isolated virtual machines on CRACI's infrastructure, and source code is processed in the job VM for the duration of the build. On the Enterprise plan, CRACI offers EU data residency with build execution on European bare-metal infrastructure. If your policy requires builds on your own hardware, Buildkite's model fits that requirement and CRACI's does not.

Which one fits

• Buildkite if you need builds on your own hardware or network, run Windows or macOS builds, use GitLab or Bitbucket, or operate at a scale where owning the compute pays off.
• CRACI if you are on GitHub Actions and want build evidence without building and operating it: recorded dependencies, egress policy, signed provenance and CRA reports from one runner.
• Both if your organization is split: Buildkite for pipelines that must stay on your hardware, CRACI for Linux GitHub Actions workflows. Heavy Linux builds, such as Yocto images, can run on CRACI runners of up to 32 vCPU and 96 GB of RAM, as described in the CRACI Yocto guide.

For the Cyber Resilience Act

The EU Cyber Resilience Act asks manufacturers to know what is in each release and to handle its vulnerabilities, with reporting obligations from September 2026 and full application from December 2027. On Buildkite, that evidence comes from the tools you run on your agents. CRACI produces it from the build record, keeps monitoring what shipped, and exports reports in PDF, HTML, CSV, Excel and JSON. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process.

Adding CRACI

For a repository on GitHub with GitHub Actions workflows, install the CRACI GitHub App on your organization and set the runner label:

runs-on: craci

Runs still appear in the GitHub UI. Read more about build-time SBOM generation and how CRACI handles security, or see pricing.