Roadmap relationship
Outcome
Connect hosted or self-managed Git sources once, browse authorized repositories and branches, and trigger deployments from verified push/pull-request events without storing unnecessary credentials in application config.
Current gap
The git:* CLI commands contain placeholder implementations and deployment source configuration is primarily manual. There is no provider connection lifecycle, repository picker, webhook reconciliation, delivery tracking, or consistent handling for GitHub, GitLab, Bitbucket, Gitea, and generic SSH/HTTPS Git.
User experience
- Provide an integrations page with connection type, owner/host, health, granted scopes, last sync/webhook delivery, test, rotate, and disconnect actions.
- Application source selection browses/searches repositories and branches, supports manual URL entry, and explains permission failures without exposing provider details.
- Auto-deploy settings show branch rules, event types, ignored paths, webhook URL/status, and recent deliveries with redacted payload summaries.
- Disconnect and credential rotation preview which applications will be affected.
Scope
- Implement connection adapters for GitHub App, GitLab, Bitbucket, Gitea, generic HTTPS token, and generic SSH/deploy key flows.
- Add repository/branch/tag discovery, pagination, connection testing, webhook create/update/delete/reconcile, and delivery status.
- Support branch, tag, monorepo root, include/exclude watch paths, submodules, shallow/full clone, and deploy-key selection.
- Map verified push and pull-request events to deployment/preview requests with deduplication.
- Expose equivalent CLI/API operations and import existing source config where possible.
Technical direction
- Define a provider-neutral source-connection interface and capability flags rather than one large conditional.
- Encrypt provider credentials through the secrets boundary; store only metadata and hashes/identifiers in the control-plane database.
- Verify signatures/tokens against the raw request body, enforce timestamp/replay windows where supported, and enqueue idempotently by delivery ID plus commit.
- Use bounded clone/fetch operations with explicit host-key policy and sanitized errors.
Safety and operability
- Request minimum provider scopes and document why each scope is required.
- Never return provider tokens, private keys, full webhook secrets, or secret-bearing clone URLs.
- Disable affected automatic deploys visibly when a connection expires; do not silently fall back to another credential.
- Audit connection, scope, webhook, credential, and auto-deploy changes.
Acceptance criteria
- Each supported provider can connect, list a repository/branch, create or reconcile a webhook, and enqueue exactly one deploy for a valid event.
- Invalid signatures, replays, deleted connections, and unauthorized repositories are rejected without information leakage.
- Generic SSH works with pinned host keys and a selected deploy key.
- Removing a connection identifies and safely disables dependent applications.
Verification
- Contract tests shared across adapters plus provider-specific pagination, webhook, rate-limit, and refresh fixtures.
- Signature/replay/deduplication and secret-redaction tests.
- End-to-end push-to-deploy and PR-to-preview flows using at least one hosted and one generic Git source.
Non-goals
- Hosting Git repositories.
- Granting write access to application source unless webhook installation requires configuration calls.
- Embedding provider-specific credentials in
cloud.config.ts.