Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
syntaqxA push to the default branch starts its runs about 8 seconds sooner, repos and work log every request while the ~60 s stalls are traced, and repos logs its slow answers with the time the caller waited. Measured on flagon-io/g1t over its last 35 pushes (the timeline's git.push times against each run's created_at and started_at): a push's first run is made 12 to 46 s after its event (usually 16 to 20), each further workflow 4 to 6 s after the one before, and a run's first job starts 1 to 3 s after it is made whenever the workspace has room. For 6e24edf2 the event was at 20:37:25.7, the actions consumer started at about 20:37:32.5 (two queue hops), Caches was made at 20:37:43.7, CI at 20:37:47.4 and Deploy at 20:37:52.8, each starting 1.4 to 2 s later. Of the 11 s inside the consumer before the first run, most was reading the twelve workflow files from repos one after another (blob at 300 to 400 ms each), twice: once to sync the workflows table for the default branch and once more, at the same commit, to start the runs. Now the sync hands back what it read, and on_event starts a default-branch push's runs from it while the branch is still at the pushed commit (read.head equals the push's after; otherwise it reads as before), and read_folders reads the files six at a time, in the tree's order. The waits of minutes some runs show (29aba25d: 7 to 8.5 min, 58def404: 5 min, Deploy runs: up to 28 min) are RUNNING_PER_WORKSPACE (four of a workspace's jobs at once) and Deploy's concurrency group, by design, not dispatch; nothing here changes them. Repos and work keep every invocation's logs (head_sampling_rate 1), with a comment to put them back to 0.1 once the stalls are found, and the deploy guide says so. Repos' p99 wall time in Workers Logs counts ctx.wait_until, which waits up to meters::FLUSH_EVERY_MS to write the meters; an RPC answer that takes a second or more now logs {"rpc", "answered_ms"} as JSON, which Workers Logs keeps as fields, so slow answers can be told from slow flushes; the svc entry of every answer's server-timing already gave callers the same time. Metering is unchanged. Checked: cargo test for g1t-actions-service (113), g1t-repos (341) and g1t-work (189), clippy for wasm32 on both services with no new warnings, node scripts/deploy.mjs manifest --check, and npm run test:deploy (92).

README.md

g1t/deploy

Builds the checkout a g1t Actions job is in and puts it on g1t.page: production when the run is on the project's production branch, the pull request's preview for a pull request's run, and the branch's preview for a run on any other branch.

name: Deploy

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  deployments: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - id: deploy
        uses: g1t/deploy@v1
      - run: echo "Live at ${{ steps.deploy.outputs.url }}"
yaml

The project must have Deployments on, and the workspace's plan must include them. The guide, Deploying from a workflow, says what is built and when.

Inputs

InputDefault
projectThe repository's one project with Deployments onThe project's slug. Needed when the repository has several.
root-dirThe project's settingWhere the project is in the checkout.
build-commandThe project's setting, else what the build findsWhat builds it.
output-dirThe project's setting, else the folder the framework writes, else the first of dist, build, out, public, _site, .output/publicThe folder a static build writes.
build-asThe project's setting, else autoWhat it is built as: auto, static, workers or docker. A container is built with the docker on the job's PATH.
dockerfileThe project's setting, else Dockerfile or ContainerfileThe Dockerfile a container is built from, relative to the project.
shaThe run's commitThe commit this is a build of, for its g1t / deploy check.
token${{ github.token }}The job's own token. It needs deployments: write; any other token is refused.

Outputs

Output
urlWhere the app is served.
deployment-idThe build's id, dpl_….
kindproduction or preview.

How it works

  1. It calls POST /repos/{owner}/{repo}/deployments/builds with the job's token. g1t checks the plan and the spend limit, decides production or preview from the run, sets the commit's g1t / deploy check to pending, and answers with a token for this build alone and the project's variables and secrets for builds of that kind.
  2. It masks that token and every secret with ::add-mask::.
  3. It runs g1t-runner deploy in the checkout, which installs, builds and uploads the app exactly as g1t's own builds do, and reports to g1t with the build's token. The build's log is in the step's.

A pull request from a fork or from someone without the Write role, and a run that had to be approved, build without the project's secrets. The build's time is the job's Actions time; it is not charged again.

g1t-runner is on g1t's machines. Elsewhere (a self-hosted runner), the action uses the one on PATH, or downloads the newest release from https://g1t.sh/downloads/runner/latest/ and checks it against the release's SHA256SUMS. It runs on Linux and macOS, with curl and either jq or python3.