Cheaper CI.
One line changes.

Sign in with GitHub at app.tempus.build — the first sign-in creates your account. Install the GitHub App tempus-build on your organization and choose which repositories to grant access to; the platform creates the runner group itself. Then replace runs-on: ubuntu-latest with runs-on: tempus-ubuntu-24.04-2core — the same size as ubuntu-latest; for heavy builds there's tempus-ubuntu-24.04-4core. Nothing else changes — it's a drop-in replacement for GitHub-hosted runners: the same Ubuntu 24.04 and compatibility with marketplace actions.

Three reasons: on 4core, 4 vCPU and 16 GB instead of the 2 vCPU and 8 GB of ubuntu-latest on private repositories; bare-metal AMD Ryzen; and a cache for Docker images, apt, Go, Maven/Gradle, NuGet, RubyGems and conda-forge in the same data-center region, over a private network. That's why compilation, tests and image builds gain the most — up to 5× on real pipelines. More in the speed section.

A GitHub organization and private repositories. Personal GitHub accounts aren't supported yet — a free organization is enough. Public repositories aren't served yet either; fork PRs to private repositories run and are billed to the organization's balance — an organization budget caps this spend. There are two runners today, both Ubuntu 24.04 x64: tempus-ubuntu-24.04-2core — 2 vCPU, 8 GB RAM, and tempus-ubuntu-24.04-4core — 4 vCPU, 16 GB RAM; 8- and 16-core are on request (get in touch). Each organization has a concurrent-job ceiling (raised on request); jobs above it wait in the queue.

Not yet: runners serve only private repositories in GitHub organizations, so there's no free plan for open source either. Fork PRs to private repositories run and are billed to the organization's balance. If public repository support matters to you, get in touch — we'll add it as demand grows.

Not yet: top-ups go through DodoPayments, which doesn't accept Russian cards. We're working on an alternative — write to billing@tempus.build. The $5 you start with works without a card.

Prices are in US dollars per minute; the balance is prepaid, in US dollars. Jobs bill the actual seconds they run — per second, no rounding. Balance and per-job history are in the dashboard. Top up by card through DodoPayments (merchant of record), from $1, with optional auto-recharge.

The model is prepaid: new jobs don't start at a zero balance; running ones finish, with an overrun of at most $1. On top of that: organization budgets that alert or stop new jobs, budget alerts per repository, workflow and actor, and email alerts for a low balance and spending spikes.

Each job runs in its own isolated VM, not a shared environment with other users: the VM is created for the job and destroyed when it finishes. The servers are located in the EU. Runner images are open source, checked against CIS Docker Benchmark image guidance and published with SLSA provenance: github.com/tempusbuild/runner-images — you can see exactly what your code runs in.

You connect through the GitHub App tempus-build: you install it on your organization and choose which repositories to grant access to. The App requests the minimum permissions — here's the full list and why each is needed:

• Self-hosted runners: read & write (organization) — registering runners and the tempus-runners group
• Members: read (organization) — member roles and repository access, so each member sees only what they can see on GitHub
• Metadata: read (repository) — the mandatory minimum for any GitHub App
• Actions: read (repository) and the workflow_job webhook events — job statuses for per-second billing; the installation, repository, organization, member and team events — keeping the organization in sync

The Contents permission isn't on the list — the platform can't read your source code through the API. Your code, just like on GitHub-hosted runners, is checked out by the job itself inside the runner and destroyed along with its micro-VM. Installation tokens are short-lived and minted on demand; we keep no long-lived per-customer tokens. Dashboard sign-in uses GitHub OAuth with the read:user, user:email and read:org scopes. App page: github.com/apps/tempus-build

The shape is determined solely by the label in runs-on and is fixed: tempus-ubuntu-24.04-2core is always a VM with 2 vCPU and 8 GB RAM, and tempus-ubuntu-24.04-4core one with 4 vCPU and 16 GB. With GitHub, ubuntu-latest on a private repository is 2 vCPU and on a public one 4; with us the spec is baked into the label and doesn't depend on the repository type. VMs run on shared bare-metal hosts: you get a separate virtual machine, not a dedicated server.

Secrets reach only the inside of the job, which runs in its own isolated VM: once the job finishes, the VM is destroyed along with its entire environment. We don't write secrets to the platform logs.

Put runs-on: ubuntu-latest back in your workflow — that's the whole migration, the same one line as when you connected. Your code, workflows, and run history stay exactly where they were — in your GitHub. There's nothing to retrieve from tempus.build: the dependency cache is just copies of public packages, and the originals are in the registry anyway. The last step is to remove the GitHub App tempus-build in your GitHub settings and, optionally, delete the tempus-runners runner group.

Unused paid balance is refunded on request (welcome and bonus grants aren't refundable).

We're not publishing an SLA yet: promising percentages before a real operating history confirms them is marketing, not a guarantee. Instead there's a public status page with website availability and incident history (dashboard and runner monitoring is being added) — judge by the facts: status.tempus.build. And per-second billing cuts both ways: if it wasn't running, you didn't pay.

No. Instead of an auditor's report: what you can verify yourself — a signed open-source image with SBOM and SLSA provenance, a separate VM per job, the public isolation model on /security.

Yes, it's on the roadmap: tempus will connect to AI agents over the Model Context Protocol. Details closer to release; announcements go to the Telegram channel t.me/tempusbuild.