Sync with GitHub

Sails has two version-control commands. Mixing them up is the usual failure.

There is no system git. git is a small bridge. After clone / pull, autosave checkpoints the tree into Sails. Run git push when the external remote should update. Do not run repo save as a ritual.

.git/ lives in the session and is not stored with repo. Scratch git state is discarded when the session ends. Store the remote URL (and the ssec_… id, never the plaintext) so the next session can git remote add again.

Done looks like

git status is clean. git log shows your commit. git push succeeds. On GitHub the branch has that commit. Sails still uses repo for publish; you did not treat git as the Sails VCS.

Worked example: clone, edit, push (HTTPS PAT)

Job: repository owner pulls https://github.com/org/app.git into ~/app, changes a file, pushes main.

Clone / fetch / pull / push are owner-only. Local status / add / commit need write access to the workspace.

1. Store the PAT

Do not put ghp_… in a file. See Store a secret.

secret open github-pat
secret poll INTAKE_ID
# prints: ssec_…

2. Clone

git clone https://github.com/org/app.git app --depth 1 --token ssec_…

--token ssec_… is the preferred HTTPS auth. You can also put ssec_… in the URL userinfo; it is resolved then stripped.

Expected: a directory app/ with the default branch. Autosave then checkpoints that tree into Sails.

git config user.email agent@example.com
git config user.name "Sails agent"

git config only supports user.name and user.email.

3. Edit, commit, push

# edit files under app/ …
git add .
git commit -m "update README"
git fetch origin --token ssec_…
git rebase origin/main
git push --token ssec_…

On conflict: edit the files, git add <paths>, git rebase --continue. Or git rebase --abort. Do not use interactive rebase (-i).

Keep the remote so you are not pasting the URL every time:

git remote add origin https://github.com/org/app.git --token ssec_…
git remote

git remote stores the URL and the token id, never the secret plaintext.

SSH deploy key

git clone git@github.com:org/app.git app --depth 1 -i ssec_deploy_key
git push -i ssec_deploy_key

SSH remotes require -i ssec_… (PEM in platform secrets). Host keys use the same per-repo TOFU pins as ssh.

Cloudflare Artifacts

Short-lived art_v1_… bearers work as --token or via:

git -c http.extraHeader='Authorization: Bearer art_v1_…' clone \
  'https://….artifacts.cloudflare.net/git/…/package-….git' pkg

Prefer wrapping the token in secret set and passing --token ssec_…. Artifacts hosts default to username x (not GitHub’s x-access-token).

Flags

git help

Supported: init, clone (--depth N), status (--porcelain), log, diff, show, add, commit, branch, checkout, merge, rebase (non-interactive; --continue / --abort), config (user.name / user.email), remote, fetch, pull (--rebase), push (-u, --force).

Not supported: interactive rebase, submodules, LFS, stash, tags, system git hooks. git rebase --skip is not available; resolve, --continue, or --abort.

Limits: remotes must pass the same network policy as curl / ssh (private/reserved IPs blocked). Clone/fetch unpacked size is capped around 250 MiB.

Failure modes

See Store a secret for ssec_…. Sails checkpoints stay on repo.