Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
syntaqxThe merge queue builds, tests and lands each pull request by its own merge method. Each state was built in a sandbox with git merge commits, then landed by fast-forward as it was, so a queued pull request always landed as a merge commit whatever method was asked; and since every sandbox built its own copy of the entries ahead, an entry's state did not descend from the one that landed before it, and a batch fell back to testing again. Now the work service builds every state in the repository itself, with repos' new build_queue_step: the entry landed by its method (merge commit, squash, rebase or fast-forward) on the state of the entry ahead of it, or on the default branch for the first, with the commits land would make there (merge_methods.rs make_on, shared with land_by; queue_step_on decides a step), pushed to the attempt's g1t-queue/ branch. Landing is then a fast-forward to exactly the tested commit, recorded as the entry's method with that commit as its merge commit; settle's resume check reads merge_commit. A fast-forward entry must contain what is ahead of it; a clash names the files and the nearest entry ahead that changed one (clashed_with); an entry that cannot be built leaves, and those behind are built in the next batch without it. The method is the one asked for when merging into the queue, else the merge queue rule's merge_method, each checked against the repository and the branch's rules; the commit message written then is kept (work 0044: queue_entries merge_method, commit_title, commit_message), else the repository's default, worked out when first built and kept in the tested stack (QueueStackItem method, message, author) so that narrowing a failure rebuilds the same commits; probes are built the same way. The landing gate judges the entry's method. No sandbox builds queue states any more: queue_build returns no jobs. Docs: the merge queue guide (how entries are tested and land, by method; no plan needed for building, merge_group runs billed as workflow runs), pull requests' merge methods, the work architecture page, and the API's merge and queue descriptions (OpenAPI regenerated). Deploy work migration 0044 first, then repos, then work. Checked: cargo test for g1t-repos (341, new: each entry lands by its method on the state ahead, a fast-forward entry is its own head and a clash names the files) and g1t-work (186, new: an entry keeps how it lands and one queued before methods merges; a clash names the nearest entry ahead), the API's OpenAPI test, the CLI's operation table and reference.

README.md

g1t/deploy

Builds the checkout a g1t Actions job is in and puts it on g1t.page: production when the run is on the project's production branch, the pull request's preview for a pull request's run, and the branch's preview for a run on any other branch.

name: Deploy

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  deployments: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - id: deploy
        uses: g1t/deploy@v1
      - run: echo "Live at ${{ steps.deploy.outputs.url }}"
yaml

The project must have Deployments on, and the workspace's plan must include them. The guide, Deploying from a workflow, says what is built and when.

Inputs

InputDefault
projectThe repository's one project with Deployments onThe project's slug. Needed when the repository has several.
root-dirThe project's settingWhere the project is in the checkout.
build-commandThe project's setting, else what the build findsWhat builds it.
output-dirThe project's setting, else the folder the framework writes, else the first of dist, build, out, public, _site, .output/publicThe folder a static build writes.
build-asThe project's setting, else autoWhat it is built as: auto, static, workers or docker. A container is built with the docker on the job's PATH.
dockerfileThe project's setting, else Dockerfile or ContainerfileThe Dockerfile a container is built from, relative to the project.
shaThe run's commitThe commit this is a build of, for its g1t / deploy check.
token${{ github.token }}The job's own token. It needs deployments: write; any other token is refused.

Outputs

Output
urlWhere the app is served.
deployment-idThe build's id, dpl_….
kindproduction or preview.

How it works

  1. It calls POST /repos/{owner}/{repo}/deployments/builds with the job's token. g1t checks the plan and the spend limit, decides production or preview from the run, sets the commit's g1t / deploy check to pending, and answers with a token for this build alone and the project's variables and secrets for builds of that kind.
  2. It masks that token and every secret with ::add-mask::.
  3. It runs g1t-runner deploy in the checkout, which installs, builds and uploads the app exactly as g1t's own builds do, and reports to g1t with the build's token. The build's log is in the step's.

A pull request from a fork or from someone without the Write role, and a run that had to be approved, build without the project's secrets. The build's time is the job's Actions time; it is not charged again.

g1t-runner is on g1t's machines. Elsewhere (a self-hosted runner), the action uses the one on PATH, or downloads the newest release from https://g1t.sh/downloads/runner/latest/ and checks it against the release's SHA256SUMS. It runs on Linux and macOS, with curl and either jq or python3.