ci-router
How it worksProvidersPricingSecurityOpen dashboard
ci-router — OpenRouter for CI

One line. Every provider.

Change runs-on to ci-router and every CI job is placed on the provider and size that best fit availability, price, performance and latency — with fallback, one bill, and a placement that learns from every run.

# .github/workflows/ci.yml runs-on: ci-router # or [ci-router, large, cost] # the router picks provider + size per repo/workflow/label

How it works

The router owns everything GitHub-facing; providers only need to run our runner.

1 · workflow_job

Our GitHub App receives the queued job with its labels, repo and workflow. A card on file is required — no card, no runs.

2 · placement

The engine scores every provider × size on live availability, list price, and learned wall-time/cost/steal/memory per (repo, workflow, label) — epsilon-greedy, with a fallback chain.

3 · boot + run

A single-use JIT config boots our own runner image on the chosen provider (thin bootstrap on third-party, warm baked image on briq). Telemetry at exit, VM destroyed.

Minutes per day, per provider

routed vCPU-time — the runs-on.com-style comparison

Minutes per day by provider01002003004002628302026-11030507
briqubicloudinstabox

Billed per day, per provider

provider cost + margin — one invoice

Billed dollars per day by provider$0.0$1.0$2.0$3.0$4.0briqubicloudinstabox2628302026-11030507
briqubicloudinstabox

Public usage

Anonymized aggregates from GET /v1/public/stats?days=30 — finalized UTC days only (the newest point is at least 2 days old and never changes once published). Buckets backed by fewer than 5 teams are withheld, and days with nothing publishable are dropped (missing ≠ zero).

Not enough public data yet — with fewer than 5 teams per bucket, nothing is published.

The routing table

API-first compute providers, resellable directly or via BYOK credentials. Adding one is a single adapter file.

Price per vCPU-minute (list)

what the placement engine optimizes against — GitHub-hosted included for reference

instabox · 2vCPU/4GiB
$0.000140
briq · own fleet
$0.000525
ubicloud · 2vCPU/4GiB
$0.000625
GitHub-hosted · 2vCPU linux
$0.008000
cheapest firstUSD per vCPU-minute

Pricing

A card on file is required to run jobs — PAYG works on list prices, no provider deal needed.

Pay as you go

cost + 15%
provider per-second cost + margin, metered per second, one Stripe invoice

Dedicated

flat fee
includes X runs/month at provider cost on reserved capacity (own briq fleet, negotiated plans)

Security

runner VM per job: JIT config as a boot secret (never logged) · image pinned by digest · no stored console output · VM + disk destroyed at job end · no route to our infra · third-party routes opt-in per team · webhook signatures verified · App key to KMS before first outside install

Irreducible truth: a workflow can always read its own secrets — use OIDC short-lived credentials and protected environments. Full model in the repo's docs/security.md.

Design process, open

This prototype's UI and brand were explored in public rounds — every board is a self-contained page served from the repo's design/ folder.