Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
syntaqxA month's git operations are charged in full, and one failing workspace no longer holds up everyone's month-end. Billing measured a month's git operations once a day at 04:17, and the 15-minute tick charged and closed the month soon after midnight on the 1st with that count, so roughly the last 20 hours of every month's operations went uncharged (late figures were then refused as the month was closed). From an hour after a month ends, each tick now takes its final count (with the plan as it was that month) and records that the month was measured (migration 0061, measured_months); charge_pending and close_months leave last month alone until then, and after three days without it go ahead and log an error, so a repos outage never holds every invoice. Without the migration both fail closed. charge_pending handled its rows in one go and stopped at the first that failed, so one workspace erroring every tick blocked every other workspace's month-end charges and closes; each row is now charged on its own, a failure logged and retried next tick. Allowance draws are no longer lost when a read after the draw fails: price versions, GB-months and the mark statement are read first, and draw_oss gives the pool's share back when the repository's share fails. Each allowance draw asks for what is left after the previous source's actual draw, so trial credit is not skipped when included credit runs out concurrently, and a failure returns exactly the draws made. An invoice's idempotency key covers the exact cents of every line, where rounding the total down let a retry whose lines moved reuse a key Stripe refuses with other amounts. Still in Stripe test mode: durable invoice attempts, draw-and-post crash recovery and finite public storage remain before live charging. Checked: cargo test -p g1t-billing (283, new: a month charged and closed only after its final count; a retry whose lines moved gets a new key) and its wasm32 check.

README.md

g1t/deploy

Builds the checkout a g1t Actions job is in and puts it on g1t.page: production when the run is on the project's production branch, the pull request's preview for a pull request's run, and the branch's preview for a run on any other branch.

name: Deploy

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  deployments: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - id: deploy
        uses: g1t/deploy@v1
      - run: echo "Live at ${{ steps.deploy.outputs.url }}"
yaml

The project must have Deployments on, and the workspace's plan must include them. The guide, Deploying from a workflow, says what is built and when.

Inputs

InputDefault
projectThe repository's one project with Deployments onThe project's slug. Needed when the repository has several.
root-dirThe project's settingWhere the project is in the checkout.
build-commandThe project's setting, else what the build findsWhat builds it.
output-dirThe project's setting, else the folder the framework writes, else the first of dist, build, out, public, _site, .output/publicThe folder a static build writes.
build-asThe project's setting, else autoWhat it is built as: auto, static, workers or docker. A container is built with the docker on the job's PATH.
dockerfileThe project's setting, else Dockerfile or ContainerfileThe Dockerfile a container is built from, relative to the project.
shaThe run's commitThe commit this is a build of, for its g1t / deploy check.
token${{ github.token }}The job's own token. It needs deployments: write; any other token is refused.

Outputs

Output
urlWhere the app is served.
deployment-idThe build's id, dpl_….
kindproduction or preview.

How it works

  1. It calls POST /repos/{owner}/{repo}/deployments/builds with the job's token. g1t checks the plan and the spend limit, decides production or preview from the run, sets the commit's g1t / deploy check to pending, and answers with a token for this build alone and the project's variables and secrets for builds of that kind.
  2. It masks that token and every secret with ::add-mask::.
  3. It runs g1t-runner deploy in the checkout, which installs, builds and uploads the app exactly as g1t's own builds do, and reports to g1t with the build's token. The build's log is in the step's.

A pull request from a fork or from someone without the Write role, and a run that had to be approved, build without the project's secrets. The build's time is the job's Actions time; it is not charged again.

g1t-runner is on g1t's machines. Elsewhere (a self-hosted runner), the action uses the one on PATH, or downloads the newest release from https://g1t.sh/downloads/runner/latest/ and checks it against the release's SHA256SUMS. It runs on Linux and macOS, with curl and either jq or python3.