CI/CD platforms compared

Who this is for

You are choosing a CI/CD platform, or reviewing the one you have, and a new question is on the list. A customer, an auditor or the EU Cyber Resilience Act asks what went into each release and whether the artifact came from the build you say it did. Every platform here can run your builds. The difference is where that evidence comes from and how much of it you assemble yourself.

CRACI is on this page for that reason, and it is not a CI platform. It is a runner for GitHub Actions: you keep GitHub Actions and change runs-on to craci. CRACI supports GitHub Actions only today. GitLab CI, CircleCI and Buildkite pipelines do not run on it. We build CRACI, so weigh that in; the other products are described from their own documentation.

Where should the SBOM come from?

There are three places a platform can get it.

1. The repository. The platform parses manifests and lockfiles. GitHub's dependency graph and GitLab's SBOM-based dependency scanning work this way. It is always on and cheap to run, and it describes what the project declares. It does not see install scripts, downloaded toolchains or packages restored from a cache, and GitHub's export reflects the default branch rather than a pinned commit.
2. A tool you add to the pipeline. You run an SBOM generator as a step, through a CircleCI orb or on your Buildkite agents. This is flexible, and the result depends on the tool and its configuration: each generator reads a different set of files and resolves them differently, so two of them pointed at the same clean checkout will not return the same component list. CRACI cannot be compared on those terms, because it records builds rather than scanning a directory.
3. The runner that watched the build. The SBOM is recorded from the traffic the job made while it ran. This is what CRACI does.

Provenance follows the same split. GitHub's artifact attestations, a step you add to a workflow, provide SLSA v1.0 Build Level 2, or Level 3 with reusable workflows. GitLab Runner can generate a SLSA 1.0 provenance statement in all tiers. Buildkite Package Registries can publish SLSA provenance that Buildkite says meets Build Level 1, on Enterprise plans. CRACI signs provenance from the runner that observed the job, and claims no SLSA level.

At a glance

The GitHub Actions column includes the GitHub platform features teams use with it: the dependency graph, Dependabot, artifact attestations and GitHub Advanced Security. Prices are as of September 2026.

The platforms

GitHub Actions

CI/CD built into GitHub, with hosted Linux, Windows and macOS runners and self-hosted runners for your own machines. Plans include 2,000 to 50,000 minutes a month, and a standard 2-core Linux runner is $0.006 per minute as of September 2026. Around it sit the dependency graph, Dependabot alerts and security updates, artifact attestations, and the paid GitHub Secret Protection and GitHub Code Security products. Best for code that already lives on GitHub. Watch out for an SBOM that describes the repository, not the build, unless you add a generator yourself.

CRACI vs GitHub-hosted runners and CRACI and GitHub Advanced Security

GitLab CI

Part of a complete DevSecOps platform: source control, merge requests, planning and CI/CD in one product. Basic SAST, secret detection and container scanning run in all tiers; Ultimate adds dependency scanning, continuous vulnerability scanning, DAST and the vulnerability report. Hosted runners cover Linux on x86-64 and arm64, with Windows and macOS in beta. As of September 2026, Free includes 400 compute minutes and Premium is $29 per user per month billed annually. Best for one vendor for the whole lifecycle. Watch out for dependency detection from lockfiles, and signed SLSA Level 3 attestations that GitLab lists as an experiment.

CRACI vs GitLab CI

CircleCI

A mature, flexible hosted CI/CD platform that connects to GitHub, GitLab and Bitbucket. It runs jobs on Docker, Linux, Arm, Windows, macOS and GPU resource classes, with self-hosted runners for your own machines. Docker layer caching is on all plans, and test splitting spreads suites across parallel executors by timing data. Its supply chain guidance centers on protecting credentials with contexts and OIDC. As of September 2026, the Free plan includes 30,000 credits a month. Best for mixed platforms and large test suites. Watch out for SBOMs and scanning that come from the orbs and tools you plug in.

CRACI vs CircleCI

Buildkite

A hybrid platform: Buildkite's SaaS control plane orchestrates, and the agents that run jobs live on your own infrastructure, so source code and secrets stay in your environment. Hosted agents are available too, at $0.004 per vCPU minute on Linux as of September 2026. Signed pipelines let agents refuse jobs modified after upload, and Test Engine handles flaky tests and test splitting. Best for builds that must run on your own hardware or network. Watch out for build security that is yours to design: Buildkite's own guidance tells you to enforce strict network egress controls on your agents.

CRACI vs Buildkite

CRACI, a secure runner for GitHub Actions

CRACI replaces the runner, not GitHub Actions. Install the CRACI GitHub App and change runs-on; runs still appear in the GitHub UI. While each job runs, a package-aware proxy records what it fetched, including packages restored from CI caches, and produces a CycloneDX or SPDX SBOM with a completeness state per job and per cache. Egress policies are validated before the job starts and fail closed, and artifacts get signed provenance. Best for GitHub Actions teams that ship software and need evidence of each release. Watch out for GitHub Actions only, Linux only, and no SAST or secret scanning.

Build-time SBOM generation

How CRACI fits

CRACI is an addition to GitHub Actions, not a replacement for a CI platform. On GitHub, a common setup is GitHub Advanced Security and Dependabot on every pull request, and CRACI as the runner that records each build, enforces egress policy and signs provenance. Monitored SBOMs are re-evaluated as new vulnerabilities appear, and reports export in PDF, HTML, CSV, Excel and JSON. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider Cyber Resilience Act compliance process.

If your pipelines are on GitLab CI, CircleCI or Buildkite, using CRACI means moving those pipelines to GitHub Actions, or waiting: other CI systems are on the roadmap. CRACI is not the right choice when:

• You want one platform for code, planning, CI and scanning. GitLab is built for that.
• Builds must run on your own hardware or network. Buildkite and self-hosted runners fit; CRACI is managed only.
• You need Windows, macOS or GPU builds. CRACI is Linux only.
• You need a documented SLSA level today. GitHub's artifact attestations provide one.

See CRACI pricing and CI/CD integration.