Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
syntaqxA workspace's AI is its own setting, not an integration. AI providers and what Ask answers with were connections like Sentry's or Linear's: rows of `connections`, cards in the Integrations directory, `provider` values of the integration operations. Integrations are becoming a directory others publish to; a workspace's AI is a base setting g1t looks after itself. Contracts: `g1t_contracts::ai` (and packages/contracts ai.ts) has AiProvider (the 14), AiGroup (labs, platforms, self_hosted), AiConfig, AiConnection and their methods' arguments, and the Ask types moved there; AskSetup names the provider by `provider_id` and `provider_name` (were connection_id, connection_name). `integrations::Provider` is sentry, datadog, webhook, jira and linear; ProviderKind loses Models, ConnectionConfig its base_url, auth_header and model, Connection its models. Storage: integrations migration 0011 makes `ai_providers` and `ai_routes`, moves the AI rows out of `connections` with their ids (sealed keys are bound to the id, and managed_agents and agent_runs keep finding them), keeps Ask's route and drops `model_routes`; renaming and deleting a workspace cover both tables. The service keeps them in src/ai.rs with methods of their own (ai_list, ai_add, ai_update, ai_remove, ai_test, ask_settings, set_ask_settings, ask); a provider's key is checked when added and on each test; removing one turns Ask off when it answered with it and forgets its managed agent. Sessions on issues find the workspace's Anthropic provider there. API: list_ai_providers, add_ai_provider, update_ai_provider, remove_ai_provider, test_ai_provider (/workspaces/{workspace}/ai/providers[/{id}[/test]]), get_ask_settings and set_ask_settings (/workspaces/{workspace}/ai/ask), under the OpenAPI tag AI; reading takes workspace:read, changing workspace:admin and an owner's own token; the integration operations take only integration providers. MCP: a tool `ai` (list_providers, add_provider, update_provider, remove_provider, test_provider, get_ask, set_ask). The CLI's operation table and command reference are regenerated. Site: AI at /<workspace>/-/ai (the sidebar's AI → Models, the command palette's AI models) holds Ask g1t, the providers and Add a provider, grouped Frontier labs, Model platforms, Self-hosted or your own gateway; AI providers are no longer in the Integrations directory or Apps, and the integrations pages are alerts and trackers only; -/integrations/models and ?add=<an AI provider> lead to -/ai. Ask's settings link, and @g1t's "not set up yet" in Chat, point there. Docs: the AI providers guide (with its API), and the integrations, Ask, sessions, CLI, plugin and MCP pages say so. Deploy the integrations migration first, then integrations, then api, chat and web. Checked: cargo test for g1t-contracts (309), g1t-integrations (70), g1t-api (204, the OpenAPI document regenerated) and the CLI (105 and 44, the command reference current); cargo check --workspace; wasm32 checks of api and integrations; every migration applied in order to SQLite with an AI provider, a Sentry connection and Ask's route; the site's tsc -b --force, 927 tests and a production build; contracts' 48; chat's 76 and typecheck; the deploy tool's 92; the docs build (521 pages).

README.md

g1t/deploy

Builds the checkout a g1t Actions job is in and puts it on g1t.page: production when the run is on the project's production branch, the pull request's preview for a pull request's run, and the branch's preview for a run on any other branch.

name: Deploy

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  deployments: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - id: deploy
        uses: g1t/deploy@v1
      - run: echo "Live at ${{ steps.deploy.outputs.url }}"
yaml

The project must have Deployments on, and the workspace's plan must include them. The guide, Deploying from a workflow, says what is built and when.

Inputs

InputDefault
projectThe repository's one project with Deployments onThe project's slug. Needed when the repository has several.
root-dirThe project's settingWhere the project is in the checkout.
build-commandThe project's setting, else what the build findsWhat builds it.
output-dirThe project's setting, else the folder the framework writes, else the first of dist, build, out, public, _site, .output/publicThe folder a static build writes.
build-asThe project's setting, else autoWhat it is built as: auto, static, workers or docker. A container is built with the docker on the job's PATH.
dockerfileThe project's setting, else Dockerfile or ContainerfileThe Dockerfile a container is built from, relative to the project.
shaThe run's commitThe commit this is a build of, for its g1t / deploy check.
token${{ github.token }}The job's own token. It needs deployments: write; any other token is refused.

Outputs

Output
urlWhere the app is served.
deployment-idThe build's id, dpl_….
kindproduction or preview.

How it works

  1. It calls POST /repos/{owner}/{repo}/deployments/builds with the job's token. g1t checks the plan and the spend limit, decides production or preview from the run, sets the commit's g1t / deploy check to pending, and answers with a token for this build alone and the project's variables and secrets for builds of that kind.
  2. It masks that token and every secret with ::add-mask::.
  3. It runs g1t-runner deploy in the checkout, which installs, builds and uploads the app exactly as g1t's own builds do, and reports to g1t with the build's token. The build's log is in the step's.

A pull request from a fork or from someone without the Write role, and a run that had to be approved, build without the project's secrets. The build's time is the job's Actions time; it is not charged again.

g1t-runner is on g1t's machines. Elsewhere (a self-hosted runner), the action uses the one on PATH, or downloads the newest release from https://g1t.sh/downloads/runner/latest/ and checks it against the release's SHA256SUMS. It runs on Linux and macOS, with curl and either jq or python3.