HoyoShipSovereign software delivery

Sail private. Arrive verified.

One supported path from repository to a verified Kubernetes release, inside your own network. Every change, build, artifact, policy decision and deployment is bound to one identity and backed by signed evidence.

Sign in Explore repositories Read the docs
Departs your repository Arrives verified, in your cluster
  1. ChangeReviewed against the exact merge result
  2. BuildIsolated runner, pinned inputs
  3. SealOne digest, SBOM and signed provenance
  4. InspectDeterministic policy with stable reasons
  5. PromoteThe same digest, through reviewed Git
  6. VerifyLive checks pass and the evidence is signed

01Manifest

Every release carries its manifest

A HoyoShip release is not a tag and a hope. It is a signed record of what left the repository, how it was built and inspected, where it landed and what was checked when it arrived. Anyone holding your public key can verify it, even when HoyoShip itself is offline.

Release manifestN° 0482
Cargo
payments-api
Seal
sha256:4be1…c09a
Departed
main@9f3c1e2 · pull request #482
Built
Isolated runner, pinned inputs
Inspected
Reference policy v3, no blocking findings
Materials
SBOM and signed provenance
Destination
staging, reconciled by Argo CD
Arrival
6 of 6 live checks passed
Signature
Your keys, verifiable offline

VerifiedHoyoShip · staging

Illustrative release manifest

02Outcomes

Less to assemble. More you can prove.

  1. Stop assembling the platform

    Forge, CI, registry, scanning, GitOps and evidence arrive as one signed distribution with one compatibility contract and one upgrade path. Your platform team runs a product instead of maintaining glue.

  2. Trust every green check

    A required check is bound to the producer allowed to publish it and to the exact commit, artifact and policy it judged. Missing, stale or contradictory evidence is never shown as success.

  3. Answer auditors from the system

    Every governed decision leaves a signed evidence manifest: who acted, under which policy, on which digest. It verifies offline, even when HoyoShip itself is unavailable.

03Passage

One passage from pull request to production

Each leg hands the next the same identity, the same digest and the same evidence. No leg assumes the next one succeeded: a merge is not a build, a sync is not a healthy application, and one HTTP 200 is not a passed release.

  1. Leg 01 · Forge

    Source and trusted review

    Repositories, pull requests, issues, packages and organizations. Each pull request carries one delivery summary of tests, artifact, security, infrastructure, environment and policy, and a required check can only be satisfied by its authorized producer.

  2. Leg 02 · Supply chain

    Isolated builds, sealed artifacts

    HoyoShip Actions run on isolated Linux runners that never see deployment, signing or secret-manager credentials. Each release is one OCI artifact with an SBOM and signed provenance, verified before it moves.

  3. Leg 03 · Security

    Policy with reasons, not opinions

    One scanner chain, normalized findings and deterministic policy with stable reason codes. Exceptions are narrow, attributable and expire on their own.

  4. Leg 04 · Infrastructure

    Infrastructure and cost at review time

    Signed OpenTofu plan evidence with destructive-change analysis that no summary can hide, and cost impact on the pull request where you enable it.

  5. Leg 05 · Delivery

    Environments, promotion and rollback

    Argo CD reconciles protected environment repositories. The same digest is promoted with attributable approval, verified by live health and smoke checks, and rolled back as a new governed release.

  6. Leg 06 · Operations

    Private by design

    A signed Helm installation on your PostgreSQL, object storage, registries and certificate authorities, with zero-egress update bundles, backup, restore and upgrade preflight built in.

04Chart

How HoyoShip connects

Every component runs inside your network, in its own trust zone. Builds never hold deployment or signing credentials, the environment connector only polls outward for scoped work, and Argo CD applies nothing that was not committed to protected Git.

HoyoShip architecture inside your network Developers push to HoyoShip. Isolated runners build and publish one sealed artifact to the registry. The platform worker evaluates policy and signs evidence with your keys into your object storage. HoyoShip commits the digest to protected environment Git, Argo CD reconciles it into Kubernetes, and the connector verifies the release and reports back. Your network 1 2 3 4 5 6 7 8 DevelopersPull requests RunnersIsolated builds HoyoShipForge, gates, API RegistryOCI, SBOM, provenance Platform workerPolicy and evidence Argo CDReconciles Git PostgreSQLState and outbox ConnectorSync and verify Object storagePackages and evidence KubernetesStaging · production Your keysPKI and signing roots
  • Untrusted build zone
  • Control plane
  • Data and keys
  • Environments
  1. 1
    PushDevelopers open a pull request on HoyoShip.
  2. 2
    BuildAn isolated runner takes the job. It never holds deployment or signing credentials.
  3. 3
    SealOne OCI artifact, its SBOM and provenance land in the registry, addressed by digest.
  4. 4
    DecideThe platform worker reads the outbox and evaluates policy with stable reasons.
  5. 5
    SignEvidence manifests are signed with your keys and kept in your object storage.
  6. 6
    PromoteA signed commit moves the digest in protected environment Git, and Argo CD reconciles it.
  7. 7
    VerifyThe connector polls for scoped work, watches the sync and runs typed live checks.
  8. 8
    RecordSigned observations return to HoyoShip, and the release becomes Verified.

Conceptual architecture. The moving lights trace one release across the chart.

05Logbook

From golden path to verified staging in under 30 minutes

Pick the containerized-service golden path and HoyoShip creates the repository, pipeline, ownership record and deployment declaration. From then on every change builds itself: tests, security checks, SBOM and provenance, one sealed artifact, a staging deployment and live checks, with no platform ticket in between.

Ship's logpayments-api
  1. T+00:00
    Golden path selectedRepository, pipeline, ownership record and deployment declaration created
  2. T+00:03
    Change proposedPull request opened; the delivery summary fills in as checks report
  3. T+00:08
    Checks passedTests and security checks on an isolated runner, bound to the exact merge result
  4. T+00:09
    MergedTrusted checks satisfied the merge gate
  5. T+00:13
    Built and sealedRelease artifact built once from main: one OCI digest, SBOM and signed provenance
  6. T+00:16
    PromotedSigned commit to protected staging Git; Argo CD reconciled the same digest
  7. T+00:21
    Verified6 of 6 health and smoke checks passed; evidence manifest signed with your keys

Verified staging in 21 minutes. No platform ticket, no manual database edit.

Illustrative log of an automated build

06Articles

The articles HoyoShip sails by

  1. Deterministic authority

    Every gate, approval and release decision works with AI switched off.

  2. Evidence over claims

    Missing, stale or contradictory evidence is never success.

  3. Immutable subject binding

    Every check names the exact commit, artifact, policy and environment it judged.

  4. Build once, promote by digest

    An artifact is never rebuilt between environments, and a mutable tag never identifies a release.

  5. GitOps is the mutation boundary

    Environments change through reviewed, versioned Git that is reconciled continuously.

  6. Least privilege

    Untrusted code never runs with deployment, signing or secret-manager credentials.

  7. Fail closed

    When an authoritative decision is missing or stale, merges and promotions stop. Reading and reviewing keep working.

  8. Private by default

    No mandatory SaaS callback, no telemetry unless you turn it on, and zero-egress operation once content is mirrored.

07Harbour

Your code. Your cluster. Your keys.

HoyoShip installs into your Kubernetes with a signed chart, runs on your database, storage and certificate authorities, and keeps delivering when the outside world is unreachable.

Sign in Read the installation guide
Your network
  • HoyoShip
  • Isolated runners
  • PostgreSQL
  • Object storage
  • Container registry
  • Argo CD
  • Your PKI and keys
No mandatory outbound connections