Documentation
0xCI Docs
Everything you need to deploy preview environments and production apps on your own AWS account.
Getting Started
Prerequisites
You need an AWS account and a GitHub repository. That's it. No CLI tools, no config files, no infrastructure knowledge required.
1. Install the GitHub App
Go to the 0xCI GitHub App page and click Install. Select the repositories you want to enable preview deployments for. GitHub will redirect you to the setup wizard automatically.
2. Connect your AWS account
In the setup wizard, select your repositories, choose your AWS region, and enter your 12-digit AWS Account ID. Click "Launch CloudFormation Stack", this creates an IAM role in your account that GitHub Actions can assume via OIDC. No long-lived credentials are ever stored.
3. Open a pull request
That's it. Open any PR in a connected repository and 0xCI will deploy a live preview environment automatically. The URL is posted as a comment on the PR. When the PR is closed or merged, the environment is destroyed.
How It Works
OIDC authentication
0xCI never stores AWS credentials. Instead, it uses OpenID Connect (OIDC), GitHub Actions obtains a short-lived token from GitHub's OIDC provider and exchanges it for temporary AWS credentials. The IAM role created by CloudFormation only trusts tokens from your specific GitHub org.
Preview environments
Each pull request gets its own isolated AWS environment deployed to a unique stage (e.g. pr-42). SST auto-detects your framework (Next.js, SvelteKit, or static) and deploys accordingly. The preview URL is a CloudFront distribution, globally cached, HTTPS by default.
Teardown
When a PR is closed or merged, the teardown workflow runs automatically and removes all AWS resources for that stage. You only pay for what's running.
Production deploys
When you merge to main, the same workflow deploys to your production stage with your custom domain (if configured). SST handles SSL certificate provisioning and DNS automatically via Route 53.
Configuration
GitHub Secrets
0xCI injects two secrets into your repository during setup: • AWS_ROLE_ARN, the ARN of the IAM role to assume • AWS_REGION, the AWS region to deploy to • DOMAIN_NAME, your production domain (if configured)
sst.config.ts
0xCI injects an sst.config.ts into your repository that auto-detects your framework. For PR stages it deploys without a domain. For the production stage it wires up your custom domain via Route 53. You can customize this file after setup.
Supported frameworks
0xCI auto-detects: • Next.js, deployed via OpenNext on Lambda + CloudFront • SvelteKit, deployed on Lambda + CloudFront • Static sites, deployed to S3 + CloudFront
Custom Domain
Requirements
Your domain must have a hosted zone in Route 53 in your AWS account. If your domain is registered elsewhere (Namecheap, GoDaddy, etc.), you need to update the nameservers to the ones Route 53 gives you, a one-time 5-minute step.
Setup
During the setup wizard, enter your domain name. 0xCI will create a Route 53 hosted zone automatically via CloudFormation and show you the 4 nameservers to set at your registrar. Once DNS propagates (usually under an hour), production deploys will go live on your domain.
SSL
SSL certificates are provisioned automatically via AWS Certificate Manager (ACM) at no cost. No manual certificate management needed.
FAQ
Does 0xCI store my AWS credentials?
Never. 0xCI uses OIDC, GitHub Actions obtains temporary credentials at runtime. No secrets are stored on 0xCI's servers.
What does it cost?
0xCI itself is free. You pay only for the AWS resources it provisions in your account. For typical usage (a few preview environments at a time), this is well within the AWS free tier, often under $1/month.
What if I already have a sst.config.ts?
0xCI checks before injecting. If a deploy.yml already exists on your default branch, it skips injection entirely. If you have a custom sst.config.ts, 0xCI won't overwrite it, you may need to merge the changes manually.
Can I add more repositories later?
Yes. Go to your GitHub App settings, add the new repository, and you'll be redirected to the setup wizard to connect it to your AWS account.
Which AWS regions are supported?
All standard AWS regions. Choose whichever is closest to your users. The CloudFormation stack for OIDC must be deployed in us-east-1, but your application can deploy to any region.