Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
syntaqxg1t's runners use only Cloudflare's named instance types, sized for the least they cost while giving a job what it needs: the standard machine (ubuntu-latest, every other hosted label and all other work) is standard-3, 2 vCPU, 8 GiB and 16 GB of disk, where a custom 1 vCPU, 4 GiB, 20 GB type had been asked for and standard-1's half vCPU, 4 GiB and 8 GB was still being served; g1t-2core is kept as a name of the same machine, so workflows that ask for it keep working, at the same price; and g1t-4core stays standard-4, 4 vCPU, 12 GiB and 20 GB, for heavier jobs. At the classes' max_instances (20, 10, 10) the runners hold at most 100 vCPU, 360 GiB and 680 GB at once, well inside the account's 1,500 vCPU and 6 TiB. The contracts' instance table and its TypeScript mirror say the same sizes; the price scale, worked out as before from Cloudflare's list prices with every vCPU busy and the Durable Object behind each, is 1.8 for g1t-4core against the standard machine. The billing keeper's base is standard-3's memory, disk and Durable Object (22.6825 millionths of a dollar a second, billed whether the CPU is busy or not), and the fallbacks follow it: 63 for a sandbox second with both vCPUs busy, 26 for a build second. Migration 0056 moves the price book to the new base at once rather than after the notice period, so g1t never charges less than a sandbox costs it: sandbox_base_second to 22.6825, and sandbox_second and build_second up by the base's growth of 10.56, replacing any rise still waiting for its date. Tests hold wrangler.jsonc to the contracts' named sizes, the scales to the list prices, and every machine's price scale to at least its base's, so an idle job that does not report its CPU still pays for the memory and disk it held. The docs' machine tables, prices and the Cloudflare deploy guide say so.

README.md

g1t/deploy

Builds the checkout a g1t Actions job is in and puts it on g1t.page: production when the run is on the project's production branch, the pull request's preview for a pull request's run, and the branch's preview for a run on any other branch.

name: Deploy

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  deployments: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - id: deploy
        uses: g1t/deploy@v1
      - run: echo "Live at ${{ steps.deploy.outputs.url }}"
yaml

The project must have Deployments on, and the workspace's plan must include them. The guide, Deploying from a workflow, says what is built and when.

Inputs

InputDefault
projectThe repository's one project with Deployments onThe project's slug. Needed when the repository has several.
root-dirThe project's settingWhere the project is in the checkout.
build-commandThe project's setting, else what the build findsWhat builds it.
output-dirThe project's setting, else the folder the framework writes, else the first of dist, build, out, public, _site, .output/publicThe folder a static build writes.
build-asThe project's setting, else autoWhat it is built as: auto, static, workers or docker. A container is built with the docker on the job's PATH.
dockerfileThe project's setting, else Dockerfile or ContainerfileThe Dockerfile a container is built from, relative to the project.
shaThe run's commitThe commit this is a build of, for its g1t / deploy check.
token${{ github.token }}The job's own token. It needs deployments: write; any other token is refused.

Outputs

Output
urlWhere the app is served.
deployment-idThe build's id, dpl_….
kindproduction or preview.

How it works

  1. It calls POST /repos/{owner}/{repo}/deployments/builds with the job's token. g1t checks the plan and the spend limit, decides production or preview from the run, sets the commit's g1t / deploy check to pending, and answers with a token for this build alone and the project's variables and secrets for builds of that kind.
  2. It masks that token and every secret with ::add-mask::.
  3. It runs g1t-runner deploy in the checkout, which installs, builds and uploads the app exactly as g1t's own builds do, and reports to g1t with the build's token. The build's log is in the step's.

A pull request from a fork or from someone without the Write role, and a run that had to be approved, build without the project's secrets. The build's time is the job's Actions time; it is not charged again.

g1t-runner is on g1t's machines. Elsewhere (a self-hosted runner), the action uses the one on PATH, or downloads the newest release from https://g1t.sh/downloads/runner/latest/ and checks it against the release's SHA256SUMS. It runs on Linux and macOS, with curl and either jq or python3.