Your release pipeline, watched every week

Release, publish and nightly jobs fail quietly: a release goes out without its binaries, an image stops publishing, a nightly job stays red for months. Each week we check those workflows in your organisation against the next runner and base image as well as today's, and write to you when one stops shipping. With the watch, the fixes come as pull requests. Without it, a fix is a fixed price, invoiced after you merge, and a build fix in a public repository is free. A key move, or a move off Defender, which retired on 1 July 2026, is priced the same way.

Public repository report	Freefor public repositories	Send your organisation's GitHub name and we send back a report on the release, publish and nightly workflows in its public repositories: jobs that are already failing and since when, releases that went out without their assets, and what breaks on the next runner or base image, each with the run or the line that shows it. It reads only public repositories and public runs, so it needs no access. A build fix for a public repository comes as a pull request and is free too. For private repositories and self-hosted release jobs, take the audit below.
Release pipeline watch	$299a month per organisation, or $2,990 a year	Each week we check every release, publish and nightly workflow in your organisation against the next runner image and the next version of each base image it builds on, and we write to you when one stops shipping: a release job that has gone red, a publish job that pushed nothing, or a release that went out without its assets. When the cause is in the build, we send the fix as a pull request. When it is a credential or registry failure, we tell you which step failed and why, because that fix needs your secrets. Container images are built with upgrade-canary, our open-source tool, and running it yourself is free. If one of our fixes is already in one of your repositories, your first month is free. The monthly plan can be cancelled any time. Merged fixes so far.
Release pipeline audit	$490fixed, invoiced on delivery	One pass over every release, publish and nightly workflow in your organisation, including private repositories and self-hosted release jobs, with read access you grant. You get a ranked list: jobs that are already failing and since when, releases that went out without their assets, and what breaks on the next runner or base image, each with the run or the line that shows it and the fix. If you start the watch, the $490 is credited in full against its invoices.
Fixed-price change	$300 to $400fixed, invoiced after merge	A build or release workflow fix in a private repository, in a pull request with the failing and the passing run: $300 per repository. A raw key on a server moved to a new key in your KMS or Turnkey account, with a relayer in front of it, the role changes as one Safe batch and the old key retired: $300. A Defender stack moved, up to three relayers and ten monitors on your keys, the address changes as one Safe batch and the SDK swap as a pull request: $400.
Hosting	$49a month, first month free	The Monitor and up to three relayers for one team, signing with your key. Cancel any time and keep the files.

Ask us

These are quoted when you ask: a release check for teams that run Monitor and Relayer themselves, run against your configuration before you upgrade; a protocol operations check and a weekly operations watch after it; a Glamsterdam send-path check for one codebase; and more relayers, more chains or high transaction volume.

Included in hosting

• Monitors on any channel the Monitor supports: Slack, Discord, Telegram, email, webhook and scripts in Python or Bash; JavaScript scripts do not run on the pinned Monitor 1.6.0 image (monitor #502). Your exported configuration, imported as it is.
• Up to three relayers, sending with your keys under the policies you set.
• Hosting is pinned to Monitor 1.6.0 and Relayer 1.8.0. Monitor 1.7.0 and Relayer 1.9.0 came out on 2026-10-22, and our own Sepolia job has run on them since 2026-10-25; the hosting pin has not moved to them yet.
• Each release staged against a copy of your configuration before your stack gets it, with an upgrade note.
• If a bug hits your stack, Nonceworks reproduces it and publishes the files.
• Scheduled calls for Chainlink-style upkeeps, from your own address, once the runner is past testing; it has run our own hourly job on Ethereum Sepolia since 2026-10-11, with 14 hourly slots missed around a server outage on 10 November (the count and its limits), and has not run on mainnet yet.

Before a move

Hosting after a key move or a Defender move is $49 a month. AWS KMS signing has been tested end to end against a real AWS key; Google Cloud KMS and Turnkey have not, so before a move we run your key end to end on a testnet. The Defender migration guide has the steps for a move off Defender.

To start, email hello@nonceworks.com with your organisation's GitHub name, or write on Telegram. For public repositories we send back the free report. For private repositories and self-hosted jobs we reply with the read access the audit needs, and invoice it when we deliver. For anything else, send the repository or the configuration.

Invoices are in USD. Fixed-price changes are invoiced after you merge the pull request or execute the Safe batch, and the audit when we deliver it. The home page lists the limits of the service, and the security page covers what the grant on your key allows.