Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| g1t has actions of its own: g1t/deploy builds the checkout a job is in and puts it on g1t.page, opening the build with the job's token, masking the build's token and the project's secrets, and running g1t-runner deploy, with the app's url, the deployment's id and its kind as outputs; g1t/detect says what such a build would find (kind, install, build and output-dir) without building anything. Both use the g1t-runner on the machine, or download the newest release from g1t.sh/downloads/runner and check it against its SHA256SUMS. They live under actions/, and the Actions release workflow pushes each folder to its own repository in the g1t workspace and moves its v1 tag whenever main changes them, with the G1T_ACTIONS_PUBLISH_TOKEN secret its header describes. | 1 | # g1t/deploy |
| 2 | ||
| 3 | Builds the checkout a g1t Actions job is in and puts it on | |
| 4 | [g1t.page](https://docs.g1t.sh/guides/deployments/): production when the | |
| 5 | run is on the project's production branch, the pull request's preview for | |
| 6 | a pull request's run, and the branch's preview for a run on any other | |
| 7 | branch. | |
| 8 | ||
| 9 | ```yaml | |
| 10 | name: Deploy | |
| 11 | ||
| 12 | on: | |
| 13 | push: | |
| 14 | branches: [main] | |
| 15 | pull_request: | |
| 16 | ||
| 17 | permissions: | |
| 18 | contents: read | |
| 19 | deployments: write | |
| 20 | ||
| 21 | jobs: | |
| 22 | deploy: | |
| 23 | runs-on: ubuntu-latest | |
| 24 | steps: | |
| 25 | - uses: actions/checkout@v5 | |
| 26 | - id: deploy | |
| 27 | uses: g1t/deploy@v1 | |
| 28 | - run: echo "Live at ${{ steps.deploy.outputs.url }}" | |
| 29 | ``` | |
| 30 | ||
| 31 | The project must have Deployments on, and the workspace's plan must | |
| 32 | include them. The guide, | |
| 33 | [Deploying from a workflow](https://docs.g1t.sh/guides/deployments/#deploying-from-a-workflow), | |
| 34 | says what is built and when. | |
| 35 | ||
| 36 | ## Inputs | |
| 37 | ||
| 38 | | Input | Default | | | |
| 39 | | --- | --- | --- | | |
| 40 | | `project` | The repository's one project with Deployments on | The project's slug. Needed when the repository has several. | | |
| 41 | | `root-dir` | The project's setting | Where the project is in the checkout. | | |
| 42 | | `build-command` | The project's setting, else what the build finds | What builds it. | | |
| g1t.page builds know the framework a project is built with, from its package's dependencies and config files: Vite (and React, Vue, Svelte, Solid or Preact on it), Astro, Next.js with `output: 'export'`, SvelteKit with the static adapter, Nuxt by `nuxi generate`, React Router and Remix in SPA mode, Gatsby, Docusaurus, Eleventy, Angular, Create React App, Hugo, Jekyll and mdBook are each built with their own command and served from the folder they write, read from their config where it moves it. A Cloudflare adapter's Worker deploys as a Workers project with no Wrangler config of the project's own: Astro's, which now writes its config for wrangler in `.wrangler/deploy/config.json` (as `@cloudflare/vite-plugin` does, and that is read too), SvelteKit's `.svelte-kit/cloudflare/_worker.js`, and OpenNext's with a `wrangler.jsonc`; a site's `_worker.js`, `_routes.json` and what `.assetsignore` lists are never uploaded, and a written config's empty binding lists are no longer warned about. A framework set up to need a server (Next.js without a static export, Astro's server output, SvelteKit's auto or node adapter, a server-rendered React Router or Remix app) fails before anything is installed, saying what to change, in place of "found nothing to serve". The project's Build command and Output directory still win. The build's log names the framework, the finish report carries it as `framework` (which the deployments service ignores for now), and `g1t-runner detect` and the `g1t/detect` action output it. What deploys has a table of every framework, and the detect action's README lists them. | 43 | | `output-dir` | The project's setting, else the folder the framework writes, else the first of `dist`, `build`, `out`, `public`, `_site`, `.output/public` | The folder a static build writes. | |
| g1t has actions of its own: g1t/deploy builds the checkout a job is in and puts it on g1t.page, opening the build with the job's token, masking the build's token and the project's secrets, and running g1t-runner deploy, with the app's url, the deployment's id and its kind as outputs; g1t/detect says what such a build would find (kind, install, build and output-dir) without building anything. Both use the g1t-runner on the machine, or download the newest release from g1t.sh/downloads/runner and check it against its SHA256SUMS. They live under actions/, and the Actions release workflow pushes each folder to its own repository in the g1t workspace and moves its v1 tag whenever main changes them, with the G1T_ACTIONS_PUBLISH_TOKEN secret its header describes. | 44 | | `sha` | The run's commit | The commit this is a build of, for its `g1t / deploy` check. | |
| 45 | | `token` | `${{ github.token }}` | The job's own token. It needs `deployments: write`; any other token is refused. | | |
| 46 | ||
| 47 | ## Outputs | |
| 48 | ||
| 49 | | Output | | | |
| 50 | | --- | --- | | |
| 51 | | `url` | Where the app is served. | | |
| 52 | | `deployment-id` | The build's id, `dpl_…`. | | |
| 53 | | `kind` | `production` or `preview`. | | |
| 54 | ||
| 55 | ## How it works | |
| 56 | ||
| 57 | 1. It calls `POST /repos/{owner}/{repo}/deployments/builds` with the job's | |
| 58 | token. g1t checks the plan and the spend limit, decides production or | |
| 59 | preview from the run, sets the commit's `g1t / deploy` check to pending, | |
| 60 | and answers with a token for this build alone and the project's | |
| 61 | variables and secrets for builds of that kind. | |
| 62 | 2. It masks that token and every secret with `::add-mask::`. | |
| 63 | 3. It runs `g1t-runner deploy` in the checkout, which installs, builds and | |
| 64 | uploads the app exactly as g1t's own builds do, and reports to g1t with | |
| 65 | the build's token. The build's log is in the step's. | |
| 66 | ||
| 67 | A pull request from a fork or from someone without the Write role, and a | |
| 68 | run that had to be approved, build without the project's secrets. The | |
| 69 | build's time is the job's Actions time; it is not charged again. | |
| 70 | ||
| 71 | `g1t-runner` is on g1t's machines. Elsewhere (a self-hosted runner), the | |
| 72 | action uses the one on `PATH`, or downloads the newest release from | |
| 73 | `https://g1t.sh/downloads/runner/latest/` and checks it against the | |
| 74 | release's `SHA256SUMS`. It runs on Linux and macOS, with `curl` and either | |
| 75 | `jq` or `python3`. |