Skip to content
Sign up

flagon-io/g1t

public
0
syntaqxRepository pages update live while you sit on them. A signed-in tab on a repository page asks the site to watch it (POST /-/notify, watch_repo), which checks the person can read it and tells notify; notify keeps one topic per repository (a new Topic Durable Object, migration v3) of whose feeds are watching, for fifteen minutes at a time, renewed while the page stays open. The events service passes every event a page shows (pushes and deletions, pull requests, issues, comments, reviews, checks, statuses, runs, releases, deployments, security alerts) to notify as a small repo_changed note naming only its kind, ref, number, commit, run and commit count (g1t_contracts::live), one call per batch, and the actions service tells it of runs' jobs starting and finishing (run.updated, over a new optional NOTIFY binding). Notify hands each change to the watching feeds, which send it to their tabs as a `repo` event. On the page, useRepoLive (lib/use-repo-live.ts) revalidates the loader a second after the last matching change (five at most), never while someone is typing or a dialog is open, and at most once a minute in a hidden tab; signed out or with the socket down it refreshes on coming back into view (at most every 30 s) and once a minute while in view. Used on the overview, Files and folders, Commits (new commits wait under an "N new commits · Show" bar), Tags, the pull request and issue lists, a pull request and an issue (a reader at the bottom follows new timeline items), the Actions runs list (its 3 s poll becomes 30 s with the socket up) and a run (10 s for steps with the socket up), and the Security pages. The notifications guide has a new "Pages that update live" section.

README.md

g1t/deploy

Builds the checkout a g1t Actions job is in and puts it on g1t.page: production when the run is on the project's production branch, the pull request's preview for a pull request's run, and the branch's preview for a run on any other branch.

name: Deploy

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  deployments: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - id: deploy
        uses: g1t/deploy@v1
      - run: echo "Live at ${{ steps.deploy.outputs.url }}"
yaml

The project must have Deployments on, and the workspace's plan must include them. The guide, Deploying from a workflow, says what is built and when.

Inputs

InputDefault
projectThe repository's one project with Deployments onThe project's slug. Needed when the repository has several.
root-dirThe project's settingWhere the project is in the checkout.
build-commandThe project's setting, else what the build findsWhat builds it.
output-dirThe project's setting, else the first of dist, build, out, public, _site, .output/publicThe folder a static build writes.
shaThe run's commitThe commit this is a build of, for its g1t / deploy check.
token${{ github.token }}The job's own token. It needs deployments: write; any other token is refused.

Outputs

Output
urlWhere the app is served.
deployment-idThe build's id, dpl_….
kindproduction or preview.

How it works

  1. It calls POST /repos/{owner}/{repo}/deployments/builds with the job's token. g1t checks the plan and the spend limit, decides production or preview from the run, sets the commit's g1t / deploy check to pending, and answers with a token for this build alone and the project's variables and secrets for builds of that kind.
  2. It masks that token and every secret with ::add-mask::.
  3. It runs g1t-runner deploy in the checkout, which installs, builds and uploads the app exactly as g1t's own builds do, and reports to g1t with the build's token. The build's log is in the step's.

A pull request from a fork or from someone without the Write role, and a run that had to be approved, build without the project's secrets. The build's time is the job's Actions time; it is not charged again.

g1t-runner is on g1t's machines. Elsewhere (a self-hosted runner), the action uses the one on PATH, or downloads the newest release from https://g1t.sh/downloads/runner/latest/ and checks it against the release's SHA256SUMS. It runs on Linux and macOS, with curl and either jq or python3.