Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
syntaqxAn agent can turn on a project's g1t.page deployments, and have them from the moment it makes the repository: an agent (or Claude Code through the g1t MCP) could create a repository but not make it deploy, so flagon-io/session-lab needed a person to click Turn on deployments under Settings → Deployments, because only the site (that page, and Ask's new-repository card) called the deployments service's update_settings, and update_project's runs does not turn them on. Two operations now read and change a project's deployment settings as that page does, through the same service call: get_deployment_settings (GET /workspaces/{workspace}/projects/{project}/deployments/settings, deployments:read, the Read role as the service checks) and update_deployment_settings (PATCH there, repo:admin, the Admin role the page and the service require), in snake_case: enabled, production, previews, build_as, build_command, output_dir, dockerfile, instance_type, idle_days, via_workflow, with production_url, primary_domain, detected and framework read back. enabled true builds production at once; without the g1t plan it is refused with 402 payment_required saying where an owner starts it, without Admin with 403, and for a library, tool or other with 409, as the site says; bad values are refused with 422 before the service is asked. They are actions of the MCP workflow tool next to the deployment actions, and the CLI has g1t deploy settings (flags such as --previews off and --build-command change them), g1t deploy enable and g1t deploy disable, which find the current repository's project as g1t logs does (logs' resolve_project). create_repo takes deploy (REST, the repository tool's create, g1t repo create --deploy): once the repository is made its project's deployments are turned on as Ask's card does it, as its creator, and the response adds deployments (the settings) and deploy_error (why not); the repository is made either way, and deploy needs no scope beyond repo:create since the creator is its admin. Run credentials never change deployment settings (NEVER), and get_deployment_settings is a read for the audit log. The site keeps its own calls (ask.ts and the Settings page call the same service method the API now does). The deployments guide (Without the site, Settings), the deployments API guide, projects, the CLI guide, the MCP reference, reference.json and the regenerated openapi.json, CLI ops table and CLI reference say how. Deploy order: api, then the docs; the CLI commands ship with the next CLI release; no service or migration changes. Checked: cargo test -p g1t-api (211; openapi regenerated with G1T_WRITE_OPENAPI), -p g1t-contracts (316), -p g1t (110 + 51; ops_table and cli_reference regenerated with G1T_WRITE_OPS and G1T_WRITE_DOCS); cargo check -p g1t-api --target wasm32-unknown-unknown; node --test apps/web/app/lib/token-scopes.test.ts.

README.md

g1t/deploy

Builds the checkout a g1t Actions job is in and puts it on g1t.page: production when the run is on the project's production branch, the pull request's preview for a pull request's run, and the branch's preview for a run on any other branch.

name: Deploy

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  deployments: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - id: deploy
        uses: g1t/deploy@v1
      - run: echo "Live at ${{ steps.deploy.outputs.url }}"
yaml

The project must have Deployments on, and the workspace's plan must include them. The guide, Deploying from a workflow, says what is built and when.

Inputs

InputDefault
projectThe repository's one project with Deployments onThe project's slug. Needed when the repository has several.
root-dirThe project's settingWhere the project is in the checkout.
build-commandThe project's setting, else what the build findsWhat builds it.
output-dirThe project's setting, else the folder the framework writes, else the first of dist, build, out, public, _site, .output/publicThe folder a static build writes.
build-asThe project's setting, else autoWhat it is built as: auto, static, workers or docker. A container is built with the docker on the job's PATH.
dockerfileThe project's setting, else Dockerfile or ContainerfileThe Dockerfile a container is built from, relative to the project.
shaThe run's commitThe commit this is a build of, for its g1t / deploy check.
token${{ github.token }}The job's own token. It needs deployments: write; any other token is refused.

Outputs

Output
urlWhere the app is served.
deployment-idThe build's id, dpl_….
kindproduction or preview.

How it works

  1. It calls POST /repos/{owner}/{repo}/deployments/builds with the job's token. g1t checks the plan and the spend limit, decides production or preview from the run, sets the commit's g1t / deploy check to pending, and answers with a token for this build alone and the project's variables and secrets for builds of that kind.
  2. It masks that token and every secret with ::add-mask::.
  3. It runs g1t-runner deploy in the checkout, which installs, builds and uploads the app exactly as g1t's own builds do, and reports to g1t with the build's token. The build's log is in the step's.

A pull request from a fork or from someone without the Write role, and a run that had to be approved, build without the project's secrets. The build's time is the job's Actions time; it is not charged again.

g1t-runner is on g1t's machines. Elsewhere (a self-hosted runner), the action uses the one on PATH, or downloads the newest release from https://g1t.sh/downloads/runner/latest/ and checks it against the release's SHA256SUMS. It runs on Linux and macOS, with curl and either jq or python3.