How Corenna works

Zero clone. Your code never leaves GitHub.

Most build services copy your repository onto their own servers to build it. Corenna doesn't. It writes a build workflow into your repo and lets GitHub Actions do the work, on your account, under GitHub's security. What comes back is a signed Android or iOS app, signed with keys and accounts that belong to you.

Check my repo — no account Start for $1

What that means for you

Zero clone

Corenna's servers never download a copy of your repository. To check your setup they read the file list and a few config files, such as package.json, through GitHub's API. The build itself runs inside your repo on GitHub Actions, so your source code stays on GitHub from start to finish.

GitHub's security

Corenna's GitHub App only reaches the repos you pick. Signing secrets are stored as your repo's GitHub Actions secrets, encrypted with GitHub's sealed-box encryption and only opened inside the build machine. Every build gets a fresh GitHub-hosted machine that is thrown away afterwards, and your GitHub account's two-factor sign-in still guards it all.

Minimal storage

Corenna keeps only what it needs to hand you the result: the finished app file for your download link, your signing keys (encrypted), build logs with secrets removed, and your project settings. No source code, no dependency folders, no build caches. Old sandbox build records are cleared after 30 days.

Your GitHub Actions minutes

Builds run on your GitHub account's runners. Runners are free for public repos; private repos use your plan's included minutes (2,000 a month on GitHub Free), and macOS minutes for iOS count about ten times. Corenna runs no build servers of its own and adds no markup on compute.

Your Apple account

iOS apps are signed with your own Apple Developer certificate and provisioning profile, so the app is published under your name. You upload the signed .ipa to App Store Connect yourself. Corenna never asks for your Apple ID or its password.

Your keys

The Android signing key Corenna makes is yours: view its passwords and download it from the project's Signing tab whenever you like. Keep it somewhere safe, because every future update of your app has to be signed with it.

How a build runs

You install Corenna's GitHub App on the repos you choose. Nothing else on your account is reachable.
Corenna reads your repo's file list and config through GitHub's API to check the setup, then commits a build workflow to your repo.
Your signing secrets are encrypted with GitHub's key for your repo and saved as GitHub Actions secrets.
When you press Build, GitHub starts a fresh machine in your repo, builds and signs the app there, and deletes the machine afterwards.
The signed file comes back to Corenna for your download link, or goes straight to Google Play if you connected it.

Questions

What does Corenna write to my repo?: The build workflow file in .github/workflows, and for a web app that is missing it, the Capacitor setup files. Both arrive as normal commits you can read in your history.
Does Corenna store my app file?: Yes, the finished signed file is kept so your download link works. A copy also stays in your repo's GitHub Actions artifacts for 30 days, in your own GitHub storage.
Do builds of private repos cost me GitHub minutes?: Yes. Builds run in your repo, so they use your GitHub plan's included minutes, the same as any other workflow you run. Public repos build on GitHub's free runners.
Can I stop using Corenna and keep building?: Yes. The workflow file is already in your repo, your keys can be downloaded, and Settings has a self-host export with everything needed to run the builds without Corenna.

The full detail on keys, encryption and logs is on the Security page, and the story behind the design is in Why Corenna never copies your code.