Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
syntaqxNotifications settle themselves once nothing is left to do, and Home's Needs you shows your pull requests that are ready to merge or need you. Live today, Home's "From your notifications" and `g1t status` still listed "Deploy failed on main" (Run 327) and "CI failed on main" (Run 243) hours after later runs on main passed, "Reviews asked of you" listed flagon-io/g1t#39 after it merged, flagon-io/automation-lab#38 told its author "turned off auto-merge: It joined the merge queue" though the queue then merged it, and Needs you said 0 while #41 (CI passed, no approvals required) waited only for its author to merge it. The inbox only ever closed three things by itself (an agent's stall when it went on, a removed review request, an answered invitation); everything else stayed unread until marked by hand. Now the events service settles an item (marks it done and read, so it leaves the unread count, the bell, Needs you and `g1t status`, and stays in Done with its history) when the event that ends it arrives (services/events/src/inbox.rs, "Settling"): a workflow's failures on a branch when that workflow next passes there; a pull request's failed checks when checks.completed passes on its head; a deployment's failure when that production or preview deploys; a deployment waiting for review when its run ends; a review request when it is removed from you or your team; a token approval when an owner decides it; a bypass request when it is decided; your own item on a thread when you comment or review there; and everything about an issue or pull request, its previews included, once it merges or closes. A merge or close still reaches each thread's history but settles it at once, so nobody is pushed a notification that is already done. Two kinds are gone: "is live again" after a failed deployment (it settles the failure instead; watchers who chose deployments still hear of every deployment) and auto-merge turned off because the pull request joined the merge queue (work's pull.auto_merge_disabled now says `queued`, and the inbox tells nobody). Migration 0011 settles, once, items written before this whose cause the event log shows is over: run failures passed since, deployment failures deployed since, threads of issues and pull requests merged or closed since, and the merge-queue auto-merge notices. Each settled person's live count is told again. On the work side, every open pull request's remembered lifecycle is now shown in lists (list_active_pulls), not only those g1t's agent made: advance, which the runner calls on every event that can move one, remembers it for pull requests with auto-merge on too and reads whether one is behind as stored with its mergeability rather than asking repos (g1t's own still ask, since it merges them); after a merge, managed_pulls for that repository includes every open one with a remembered lifecycle; a settings or ruleset change forgets the repository's remembered lifecycles, so each is worked out again on its next showing. Home and Code's Overview turn your pull request's lifecycle into rows in the workspace: needs_you as Resolve (a conflict) or Decide, and ready as "Ready to land when you merge it." with Merge, a Ready to merge chip and its required checks shown passing. The notifications guide has a section on threads that settle themselves; the Home, pull requests (auto-merge) and webhooks guides say what changed. Checked: cargo test -p g1t-events (64, 7 of them new, for the settling rules), -p g1t-work (189), -p g1t-contracts (312), -p g1t-api the_docs_copy_is_current; clippy adds no warning; the site's tsc -b --force and unit tests (934); the docs build; migration 0011 against sample rows in SQLite.

README.md

g1t/deploy

Builds the checkout a g1t Actions job is in and puts it on g1t.page: production when the run is on the project's production branch, the pull request's preview for a pull request's run, and the branch's preview for a run on any other branch.

name: Deploy

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  deployments: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - id: deploy
        uses: g1t/deploy@v1
      - run: echo "Live at ${{ steps.deploy.outputs.url }}"
yaml

The project must have Deployments on, and the workspace's plan must include them. The guide, Deploying from a workflow, says what is built and when.

Inputs

InputDefault
projectThe repository's one project with Deployments onThe project's slug. Needed when the repository has several.
root-dirThe project's settingWhere the project is in the checkout.
build-commandThe project's setting, else what the build findsWhat builds it.
output-dirThe project's setting, else the folder the framework writes, else the first of dist, build, out, public, _site, .output/publicThe folder a static build writes.
build-asThe project's setting, else autoWhat it is built as: auto, static, workers or docker. A container is built with the docker on the job's PATH.
dockerfileThe project's setting, else Dockerfile or ContainerfileThe Dockerfile a container is built from, relative to the project.
shaThe run's commitThe commit this is a build of, for its g1t / deploy check.
token${{ github.token }}The job's own token. It needs deployments: write; any other token is refused.

Outputs

Output
urlWhere the app is served.
deployment-idThe build's id, dpl_….
kindproduction or preview.

How it works

  1. It calls POST /repos/{owner}/{repo}/deployments/builds with the job's token. g1t checks the plan and the spend limit, decides production or preview from the run, sets the commit's g1t / deploy check to pending, and answers with a token for this build alone and the project's variables and secrets for builds of that kind.
  2. It masks that token and every secret with ::add-mask::.
  3. It runs g1t-runner deploy in the checkout, which installs, builds and uploads the app exactly as g1t's own builds do, and reports to g1t with the build's token. The build's log is in the step's.

A pull request from a fork or from someone without the Write role, and a run that had to be approved, build without the project's secrets. The build's time is the job's Actions time; it is not charged again.

g1t-runner is on g1t's machines. Elsewhere (a self-hosted runner), the action uses the one on PATH, or downloads the newest release from https://g1t.sh/downloads/runner/latest/ and checks it against the release's SHA256SUMS. It runs on Linux and macOS, with curl and either jq or python3.