Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp

Commit

Merge branch 'worktree-agent-a67ecd3ec4c5efc25'

# Conflicts: # apps/docs/src/content/docs/guides/notifications.md

syntaqxcommitted Parentsd253009368d944Browse files
7 files+118−400/7 viewed
+12−6
77 import Diagram from '../../../components/Diagram.astro';
88
99 Everything that runs code you did not write runs in a sandbox: workflow
10−jobs, merge queue builds, deployments, dependency updates, backups. Three
11−pieces share the work.
10+jobs, merge checks, deployments, dependency updates, backups. Three pieces
11+share the work.
1212
1313 | Piece | Is | Does |
1414 | --- | --- | --- |
2626 <Diagram name="actions-job" />
2727
2828 1. **Trigger.** `actions` reads its event queue, `g1t-events-actions`, ten
29− at a time (step 1), and matches each event to the workflows read from
30− the default branch's `.g1t/workflows` (or `.github/workflows`). The
31− files are GitHub Actions syntax, unchanged; [GitHub
29+ at a time (step 1), and matches each event to the workflows in
30+ `.g1t/workflows` at the commit the event is about (the default branch
31+ for schedules, issues and manual runs; `services/actions/src/sync.rs`).
32+ g1t never reads `.github/workflows`. The files are GitHub Actions
33+ syntax, unchanged; [GitHub
3234 Actions](/guides/actions/) lists what is supported.
3335 2. **Plan.** It expands matrices, orders jobs by `needs`, and reports the
3436 run as pending on the commit (steps 2 and 3).
148150 | Mode | Started by | Does |
149151 | --- | --- | --- |
150152 | `actions` | `actions` | A workflow job |
151−| `queue` | `runner`, when the queue changes | Builds a merge queue candidate |
152153 | `mergecheck` | `runner`, when a pull request changes | Checks whether a pull request merges cleanly |
153154 | `deploy` | `deployments` | Builds an app ([Deployments](/architecture/deployments/)) |
154155 | `bump` | `security` | Makes a dependency update |
155156 | `backup` | `runner`'s sweep, every 5 minutes | Cuts a repository backup ([Git](/architecture/git/#backups)) |
156157
158+The merge queue needs no sandbox of its own: `work` builds each queued
159+state in the repository itself ([Work](/architecture/work/#the-merge-queue)),
160+and only the workflows that run on `merge_group` run in sandboxes, as
161+workflow jobs.
162+
157163 Compute is admitted through billing: a sandbox starts only after
158164 `billing` holds its estimated cost (`reserve`), and the hold is settled
159165 with the real cost when it ends (`settle`).
+2−2
3939 | Field | Holds |
4040 | --- | --- |
4141 | `kind` | `User`, `Workspace`, `Agent` or `System`: what kind of principal this is |
42−| `workspaces` | Each membership: the role, the workspace's base permission, organisation roles such as billing or security manager, and privileges |
42+| `workspaces` | Each membership: the role, the workspace's base permission, the roles that add to a member, such as billing or security manager, and privileges |
4343 | `grants` | Roles on repositories, directly or through teams |
4444 | `acting` | For a job or run token: the narrower scope it acts within |
4545
6363
6464 | Level | Roles |
6565 | --- | --- |
66−| Workspace | Owner and member, plus organisation roles (billing manager, security manager) and member privileges |
66+| Workspace | Owner and member, plus the roles that add to a member (billing manager, security manager) and member privileges |
6767 | Repository | Read, Triage, Write, Maintain and Admin, given to a person, a team, or everyone in the workspace as its base permission |
6868 | Outside collaborators | A repository role for someone who is not a member |
6969
+1−1
3838 | `services/notify` | TypeScript | core | Notifications, live pages, presence, browser and phone push | A Durable Object per person, per workspace and per repository | `identity` |
3939 | `services/telemetry` | TypeScript | core | Logs, traces, metrics and errors for projects, at `otel.g1t.sh` | A Durable Object per project | `billing` |
4040 | `services/billing` | Rust | core | Usage, holds and settlements, limits, Stripe | D1 `g1t-billing` | `identity`, `packages`, `repos` |
41−| `services/integrations` | Rust | core | Model providers, alert sources, issue trackers, the GitHub App, Ask g1t | D1 `g1t-integrations` | `identity`, `projects`, `repos`, `work` |
41+| `services/integrations` | Rust | core | The workspace's AI providers and Ask g1t, alert sources, issue trackers, the GitHub App | D1 `g1t-integrations` | `identity`, `projects`, `repos`, `work` |
4242 | `services/webhooks` | Rust | core | Webhook subscriptions and signed deliveries with retries | D1 `g1t-webhooks` | `identity`, `repos` |
4343 | `services/og` | TypeScript | core | Social cards and page screenshots, at `og.g1t.sh` | The screenshots bucket | `billing`, `identity`, `projects`, `repos`, `work` |
4444
+7−5
9595 and whether the person asking may bypass it. A merge happens only when
9696 none fails or waits, for people and coding agents alike.
9797
98−When everything passes, `work` asks `repos` to land the pull request's
99−head on the base, and publishes `pull.merged`.
98+When everything passes, `work` asks `repos` to land the pull request on
99+the base by the merge method asked for: a merge commit, squash, rebase or
100+fast-forward (`services/repos/src/merge_methods.rs`). Then it publishes
101+`pull.merged`.
100102
101103 ## The merge queue
102104
108110 <Diagram name="merge-queue" />
109111
110112 1. **Build.** Up to `max_entries_to_build` entries (4 by default) are
111− tested at once. For each, a sandbox merges the default branch with that
112− entry and every entry ahead of it, and pushes the result to
113− `g1t-queue/<entry>` in the repository.
113+ tested at once. Each entry is landed by its own merge method on the
114+ state of the entry ahead of it (the default branch, for the first), and
115+ the result is pushed to `g1t-queue/<entry>` in the repository.
114116 2. **Test.** Workflows that run on `merge_group` run on each of those
115117 commits, and the required checks have to pass there.
116118 3. **Land.** Entries land in order. Once everything ahead of it has landed,
+1−1
272272 out of date, and said the same way.
273273
274274 A CLI older than 0.3.3 records sessions but cannot acknowledge
275−[coordination updates](#working-on-g1t). The hooks then show
275+[coordination updates](/guides/sessions/#pending-coordination-updates). The hooks then show
276276 pending updates only when they change, not before every prompt, and ask
277277 Claude to tell you once to update the CLI.
278278
+3−3
6969 ## Private vulnerability reporting
7070
7171 A repository takes private reports when **Private vulnerability reporting**
72−is on: a switch on the Security overview's Reporting rows and in
73−[Security settings](/guides/security/#settings), for Admins and security
74−managers. Off by default.
72+is on: a switch on the [Security overview](/guides/security/#the-overview)'s
73+Reporting rows and on the Security section's **Settings** page, for Admins
74+and security managers. Off by default.
7575
7676 With it on, **Report a vulnerability** is on the repository's Security tab
7777 for anyone who can see it. Someone signed in reports under their name; on a
+92−22
33 > g1t (https://g1t.sh) is one open-source workspace where a team writes,
44 > reviews and ships code with the coding agents it already uses. Code is
55 > ordinary git over HTTPS, with issues, pull requests and reviews. Coding
6−> agents such as Claude Code, Codex, Cursor and Copilot connect over MCP or
6+> agents such as Claude Code, Codex, Cursor and OpenCode connect over MCP or
77 > the API and work as the person they act for
88 > (https://docs.g1t.sh/guides/bring-your-own-agent/). People talk in Chat:
99 > channels, direct messages and threads (https://docs.g1t.sh/guides/chat/).
116116 GitHub) copies its default branch.
117117
118118 7. **Push a repository.** Pushing to a repository that does not exist, in a
119− workspace the person belongs to, creates it, public by default.
119+ workspace the person belongs to, creates it, private by default.
120120
121121 ```sh
122122 git remote add g1t https://g1t.sh/WORKSPACE/REPO.git
295295 ## Where work runs
296296
297297 Your coding agent runs where the person runs it: on their machine, in
298−their CI, or anywhere else; g1t does not run it. Workflows and the merge
299−queue run on g1t's machines, so they need a paid workspace, or the
300−one-time $5 trial after a card check. Deployments need the plan; the trial
301−never covers them. Workflows and the merge queue on public repositories
302−can also run from g1t's open-source pool, after the same card check.
298+their CI, or anywhere else; g1t does not run it. Workflows, including the
299+merge queue's `merge_group` runs, run on g1t's machines, so they need a
300+paid workspace, or the one-time $5 trial after a card check. Deployments
301+need the plan; the trial never covers them. Workflows on public
302+repositories can also run from g1t's open-source pool, after the same card
303+check.
303304 Workflow jobs with `runs-on: self-hosted` run on the workspace's own
304305 machines (`g1t-runner` on any OS, or the g1t desktop app's runner) at $0,
305306 on every plan. When the plan refuses a start, the call answers with a
450451 in `confirm`). A deleted
451452 repository can be restored for 30 days (`POST {repo}/restore`, listed by
452453 `GET /workspaces/{workspace}/repos/deleted`) and is then purged; its name
453−stays taken until then, or until `POST {repo}/purge`. Maintain changes the
454−description, `website` and `topics` with `PATCH {repo}`, admin the
454+stays taken until then, or until `POST {repo}/purge`. Maintain changes
455+`website` and `topics` with `PATCH {repo}`, admin the
455456 `default_branch`, and write renames branches with
456457 `POST {repo}/branches/{branch}/rename` and `new_name` (slashes in the
457458 branch URL-encoded); only admin renames the default branch. An archived
458459 repository is read-only: pushes and merges are refused, issues and pull
459−requests are locked, and workflows do not run on it.
460+requests are locked, and workflows do not run on it. A repository has no
461+description of its own: its project's shows, changed with
462+`PATCH /workspaces/{workspace}/projects/{project}` (MCP: `workspace`
463+`update_project`).
460464
461465 ## Integrations
462466
585589 failed, the alert says why, and g1t tries again a day later; when the pull
586590 request's required checks fail, it stays open for someone to push the code
587591 changes it needs or close it. With no fix published, the alert links the
588−advisory and is checked again daily. `.g1t/dependencies.yml` (version
589−updates) is read and validated, but no version update pull requests are
590−opened yet. `g1t` is not an account and cannot be signed in to.
592+advisory and is checked again daily. Version updates: a `dependabot.yml`
593+file (version 2) at `.g1t/dependabot.yml` or `.github/dependabot.yml` on
594+the default branch has g1t open pull requests that raise dependencies on
595+the schedule it sets (guide:
596+https://docs.g1t.sh/guides/dependency-updates/). `g1t` is not an account
597+and cannot be signed in to.
591598 Guide: https://docs.g1t.sh/guides/security/
592599
593600 The security suite (scopes `security:read`, `security:write`; MCP tool
732739
733740 ## More
734741
742+Get started:
743+
735744 - [Quickstart](https://docs.g1t.sh/quickstart/)
736745 - [How g1t works](https://docs.g1t.sh/concepts/overview/)
746+- [The g1t CLI](https://docs.g1t.sh/guides/cli/)
747+- [Home](https://docs.g1t.sh/guides/home/)
748+- [Ask g1t](https://docs.g1t.sh/guides/ask/)
749+- [AI providers](https://docs.g1t.sh/guides/ai/)
750+- [Notifications](https://docs.g1t.sh/guides/notifications/)
751+- [Desktop app](https://docs.g1t.sh/guides/desktop/)
752+- [Phone app](https://docs.g1t.sh/guides/mobile/)
737753 - [Search and Explore](https://docs.g1t.sh/guides/search/)
754+- [Status and incidents](https://docs.g1t.sh/guides/status/)
755+
756+Coding agents:
757+
738758 - [Connect a coding agent](https://docs.g1t.sh/guides/bring-your-own-agent/)
739−- [Pull requests](https://docs.g1t.sh/guides/pull-requests/)
759+- [Claude Code plugin](https://docs.g1t.sh/guides/claude-code-plugin/)
760+- [Sessions, claims and dependencies](https://docs.g1t.sh/guides/sessions/)
761+- [Sessions and why-blame](https://docs.g1t.sh/guides/why-blame/)
762+
763+Chat and projects:
764+
740765 - [Chat](https://docs.g1t.sh/guides/chat/)
741766 - [Artifacts](https://docs.g1t.sh/guides/artifacts/)
767+- [Projects](https://docs.g1t.sh/guides/projects/)
768+- [Deployments](https://docs.g1t.sh/guides/deployments/)
769+- [Deployments API](https://docs.g1t.sh/guides/deployments-api/)
770+- [Observability](https://docs.g1t.sh/guides/observability/)
771+- [Packages](https://docs.g1t.sh/guides/packages/)
772+- [Secrets and variables](https://docs.g1t.sh/guides/secrets-and-variables/)
773+
774+Landing changes:
775+
776+- [Pull requests](https://docs.g1t.sh/guides/pull-requests/)
777+- [Checks](https://docs.g1t.sh/guides/checks/)
778+- [Pull requests into other branches](https://docs.g1t.sh/guides/base-branches/)
779+- [Labels](https://docs.g1t.sh/guides/labels/)
780+- [Milestones](https://docs.g1t.sh/guides/milestones/)
742781 - [The merge queue](https://docs.g1t.sh/guides/merge-queue/)
743−- [Sessions and why-blame](https://docs.g1t.sh/guides/why-blame/)
744−- [Forks and branches](https://docs.g1t.sh/concepts/forks/)
782+- [Rules](https://docs.g1t.sh/guides/rules/)
783+- [CODEOWNERS](https://docs.g1t.sh/guides/codeowners/)
784+- [Forks and working copies](https://docs.g1t.sh/concepts/forks/)
785+
786+Security:
787+
788+- [Security](https://docs.g1t.sh/guides/security/)
789+- [Dependency updates](https://docs.g1t.sh/guides/dependency-updates/)
790+- [Secret protection](https://docs.g1t.sh/guides/security/secret-protection/)
791+- [Code scanning](https://docs.g1t.sh/guides/security/code-scanning/)
792+- [Supply chain](https://docs.g1t.sh/guides/security/supply-chain/)
793+- [Advisories and reporting](https://docs.g1t.sh/guides/security/advisories/)
794+
795+Connect your tools:
796+
797+- [Integrations](https://docs.g1t.sh/guides/integrations/)
798+- [Webhooks](https://docs.g1t.sh/guides/webhooks/)
799+- [GitHub Actions](https://docs.g1t.sh/guides/actions/)
800+- [Self-hosted runners](https://docs.g1t.sh/guides/self-hosted-runners/)
801+- [Guardrails](https://docs.g1t.sh/guides/guardrails/)
802+
803+Workspaces:
804+
745805 - [Accounts and sign-in](https://docs.g1t.sh/guides/authentication/)
806+- [GitHub](https://docs.g1t.sh/guides/github/)
746807 - [Workspaces and tokens](https://docs.g1t.sh/guides/workspaces/)
747808 - [Access and roles](https://docs.g1t.sh/guides/access-and-roles/)
809+- [Permissions](https://docs.g1t.sh/guides/permissions/)
748810 - [Teams](https://docs.g1t.sh/guides/teams/)
749811 - [People and teams](https://docs.g1t.sh/guides/people-and-teams/)
750−- [CODEOWNERS](https://docs.g1t.sh/guides/codeowners/)
751812 - [Managing a repository](https://docs.g1t.sh/guides/managing-repositories/)
752−- [Integrations](https://docs.g1t.sh/guides/integrations/)
753−- [Webhooks](https://docs.g1t.sh/guides/webhooks/)
754−- [GitHub Actions](https://docs.g1t.sh/guides/actions/)
755−- [Self-hosted runners](https://docs.g1t.sh/guides/self-hosted-runners/)
756−- [Desktop app](https://docs.g1t.sh/guides/desktop/)
813+- [Releases](https://docs.g1t.sh/guides/releases/)
814+- [Forking a repository](https://docs.g1t.sh/guides/forking-repositories/)
815+- [Transferring a repository](https://docs.g1t.sh/guides/transferring-repositories/)
816+- [Audit log](https://docs.g1t.sh/guides/audit-log/)
757817 - [Usage and billing](https://docs.g1t.sh/guides/usage-and-billing/)
758818 - [Git](https://docs.g1t.sh/guides/git/)
819+
820+Run g1t yourself, and how it is built:
821+
822+- [With Docker Compose](https://docs.g1t.sh/guides/self-hosting/)
823+- [Deploy to Cloudflare](https://docs.g1t.sh/guides/deploy-to-cloudflare/)
824+- [Architecture](https://docs.g1t.sh/architecture/overview/)
825+
826+Reference:
827+
759828 - [MCP tools](https://docs.g1t.sh/reference/mcp/)
760829 - [API reference](https://docs.g1t.sh/reference/api/)
830+- [CLI commands](https://docs.g1t.sh/reference/cli/)
761831 - [Rate limits](https://docs.g1t.sh/reference/rate-limits/)
762832 - [What g1t can't do yet](https://docs.g1t.sh/about/limitations/)
763833 - [An open letter to Cloudflare](https://docs.g1t.sh/about/open-letter-to-cloudflare/)

Comments

Sign in to comment.