Getting started

Install Evitrus on the systems that already ship your software. Exporters run in your boundary and push evidence in. You do not change application code.

Create an account

Evitrus is in closed beta. Request beta access with your company, name, and work email. We provision the organisation and send sign-in details.

Self-serve signup is planned. Until that ships, new organisations come through the beta form.

Log in and create an API key

Sign in at app.evitrus.io.

Open Integrations and create a key. The secret (evt_live_…) is shown once. Store it as a secret. Never commit it.

Scope	Used by
ingest	Exporters and the SDK
evaluate	Evaluators (GitHub Actions check, Kubernetes admission)
breakglass	Opening or ending a break-glass window

This setup only needs ingest. New keys include ingest and evaluate unless you clear one. Point exporters at the managed ingest API:

POST https://api.evitrus.io/ingest
Authorization: Bearer evt_live_…
Content-Type: application/json

Connect GitHub and a runtime exporter

Connect the GitHub webhook, then one runtime exporter. The webhook records pull requests, reviews, and merges. Kubernetes or ECS records what actually deployed. Use the same commit on both so Evitrus groups them into one Change.

GitHub webhook

1. In Integrations, connect GitHub and copy the webhook URL and signing secret.
2. In GitHub, add a webhook (Organisation → Settings → Webhooks, or a repository's Settings → Webhooks).
3. Set the payload URL to the Evitrus URL, content type to application/json, and the secret to the signing secret.
4. Choose individual events: Pull requests, Pull request reviews, Check suites, and Code scanning alerts.

GitHub delivers those events straight to the Evitrus API. Full guide: GitHub webhook.

Kubernetes or ECS

Choose the runtime you deploy to.

Clone the exporter repo if you have not already, then install the chart:

git clone --depth 1 https://github.com/Evitrus/exporter.git
helm install evitrus-k8s-exporter ./exporter/k8s/chart \
  --namespace evitrus --create-namespace \
  --set ingest.url=https://api.evitrus.io/ingest \
  --set ingest.apiKey=$EVITRUS_KEY

The chart is read-only. It watches Deployment rollouts and emits deploy.succeeded when a rollout completes. Annotate workloads so the service name and commit match the GitHub webhook:

metadata:
  annotations:
    evitrus.io/service: payments-api
    evitrus.io/environment: prod
    evitrus.io/commit: a1b2c3d4e5f6

Full guide: Kubernetes exporter.

Add the EventBridge module next to the ECS service. It forwards deployment state changes (Console, CodeDeploy, CLI) to ingest.

module "evitrus_ecs_events" {
  source = "git::https://github.com/Evitrus/exporter.git//eventbridge-ecs/modules/ecs-eventbridge?ref=main"

  api_key     = var.evitrus_api_key
  ingest_url  = "https://api.evitrus.io/ingest"
  environment = "prod"

  ecs_service_arns = [aws_ecs_service.app.id]
  service_name_map = {
    (aws_ecs_service.app.name) = "payments-api"
  }
}

Apply creates an EventBridge rule and a Lambda that POSTs deploy.* events. Full guide: EventBridge → ECS.

All exporters

Exporter	What it covers
Kubernetes	Deployment rollouts, and optional ConfigMap / Secret changes
EventBridge → ECS	ECS deployments outside Terraform
GitHub webhook	Pull requests, reviews, merges, checks, code scanning
GitHub Actions	Build artifact and image digest from CI
Ingest API / SDK	Custom systems

See changes in the product

Open Changes in the app. After a merge and a rollout, the Change for that service should include the GitHub webhook events and a deploy.succeeded from Kubernetes or ECS.

Audit lists the underlying evidence events. If a type is noisy, add an ignore rule under Integrations. Exporters poll that list and skip matching events before they post.

Next steps

Evaluators are gates. They are separate from exporters: an exporter outage must not disable a gate, and a gate outage must not stop evidence.

Evaluator	When it runs
GitHub Actions	In CI, before the ship
Kubernetes	Admission, in namespaces you label

Unreachable Evaluate fail-opens. An na result does not block.