Get your first build into Hermetiq

Prerequisites

Before connecting a build, you need:

• A Bazel workspace you can run locally or in CI.
• Access to a Hermetiq project in the correct deployment.
• Permission to add a credential helper and Bazel configuration to the workspace or CI environment.

Choose your deployment path

Hermetiq Cloud

SOC 2 Type I · Trust Center ↗

1. Create or open your hosted account, then create or select the project that should receive the build.
2. Open Quickstart for that project and download the Bash or Python credential helper.
3. Copy the generated .bazelrc values. Quickstart supplies the project ID, BEP and results endpoints, credential-helper hosts, and optional cache or MCP values.

Customer-managed

Installing Hermetiq in your own cluster first? Follow the on-prem installation guide, then return here to connect a build.

1. Open the dashboard URL supplied by your organization and select the project assigned by your Hermetiq administrator.
2. Obtain the credential helper through your organization’s approved channel. Customer-managed Quickstart does not create a new hosted credential for you.
3. Copy the project-specific Quickstart configuration from that deployment. If a value is unavailable, ask the administrator to confirm the BEP, results, cache, and authentication endpoints.

See Deployments for the supported topology and Administration for project and credential ownership.

Credential security and rotation

The generated helper contains a machine identity, such as an OAuth client secret or mTLS material. Treat it like any other production secret:

• Do not commit the helper or its credentials. Add its path to .gitignore and restrict file permissions.
• In CI, inject the secret from the platform’s secret manager rather than committing the generated helper.
• Use the credential only with the matching project and deployment endpoints.
• Rotate credentials immediately if the helper is exposed: have an administrator reset the M2M OAuth client or mTLS certificate, then replace every local and CI copy.

Run your first build

If you kept the default isolated configuration, activate it with --config=hermetiq:

bazel build //... --config=hermetiq

If you chose global build entries instead, run your normal Bazel command. CI can use the same configuration once the credential helper is available in that environment.

Cloud projects that expose AI-assisted Quickstart can also use the MCP setup workflow after the credential helper is in place.

Verify the data

1. Open Build History in the same Cloud or customer-managed dashboard you configured.
2. Confirm the invocation appears under the expected project.
3. Open the build to inspect targets, actions, logs, cache, profile, or remote-execution data available for that invocation.

A recorded invocation confirms ingestion. It does not establish that actions ran remotely. For Managed Builds, continue with executor provisioning and configuration, then verify a remotely executed action.