Git-triggered ops automation inside your network: when a repository changes, call APIs, run scripts and tell webhooks.
Unified GitOps watches git repositories from inside your network. When a commit lands, it calls the APIs that should hear about it, with the files that changed as their bodies; it runs scripts from a repository, with what changed in their environment; and it tells webhooks what happened. Nothing has to reach in, no CI runner has to be registered, and every item is a YAML file in a configuration directory.
See a complete example: an API, a script and a webhook.
- Pull, not push: repositories pulled on an interval, a cron schedule or on demand
- Acts on what changed: a commit runs only the items whose files it touched
- APIs: a request per changed file or per commit; upsert, compare, delete, dry run
- Scripts: from any repository; args, env, stdin, exit codes, timeouts, output kept
- Webhooks: any HTTP receiver, the body shaped by a template over each event
- Every request option: OAuth 2.0, login flows, HMAC signing, retries, TLS, proxies
- Triggers: on a change, at startup, on a cron schedule or by hand, with a debounce
- Run history: every run, its commit and each step's outcome, in the API and the UI
- Config as code: one YAML item per file, every template and setting checked at load
- Web UI, LDAP sign-in, scoped API keys, Vault secrets, Prometheus metrics, one binary
| Document | What it covers |
|---|---|
| How it works | Pulls, changed files, triggers, runs and events |
| Example | A complete configuration directory: an API, a script and a webhook |
| APIs | Calling an API with what changed: per file or commit, upsert, compare |
| Scripts | Running a script on a change: its file, arguments and environment |
| Webhooks | Telling a receiver what happened: events, the message, body templates |
| HTTP requests | The request settings APIs and webhooks share: auth, signing, TLS, retry |
| Configuration | Every YAML file field by field |
| API | All routes with authentication and examples |
| Architecture | The layers, the dependency rule, and what is shared with unified-api |
| Configuration API | Pushing the config directory over HTTP and reloading it live |
| Deployment | Container image, Kubernetes and Compose |
| LDAP sign-in | Directory accounts, access rules and sessions |
| Observability | Logs, metrics and the alerts worth having |
| Projects | Git checkouts: when they are pulled, credentials, virtualenvs |
| Releasing | How release-please cuts a version, the CHANGELOG, a stuck release PR |
| Secrets | Credential backends, the resolution cache, native Vault |
| Testing | Running the suite and what it covers |
| Web UI | The UI the image serves and how signing in works |
Contributions are welcome: CONTRIBUTING.md covers the PR workflow, commit style, CI gates and architecture rules.
Security issues: see SECURITY.md for private reporting.