{"id":34599128,"url":"https://github.com/flyingrobots/git-stargate","last_synced_at":"2026-06-04T14:31:26.735Z","repository":{"id":326093508,"uuid":"1103875470","full_name":"flyingrobots/git-stargate","owner":"flyingrobots","description":"Git-Stargate: Forbidden git-fu harnessing a tiny wormhole to run pre/post-receive hooks on custom refs before mirroring to GitHub. Kiss my SaaS! 🌌🔧","archived":false,"fork":false,"pushed_at":"2025-11-25T14:12:26.000Z","size":7,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-11-28T19:51:37.507Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/flyingrobots.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-11-25T13:01:23.000Z","updated_at":"2025-11-25T14:23:59.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/flyingrobots/git-stargate","commit_stats":null,"previous_names":["flyingrobots/git-stargate"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/flyingrobots/git-stargate","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flyingrobots%2Fgit-stargate","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flyingrobots%2Fgit-stargate/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flyingrobots%2Fgit-stargate/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flyingrobots%2Fgit-stargate/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/flyingrobots","download_url":"https://codeload.github.com/flyingrobots/git-stargate/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flyingrobots%2Fgit-stargate/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28002250,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-12-24T02:00:07.193Z","response_time":83,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-12-24T12:07:28.378Z","updated_at":"2025-12-24T12:07:37.311Z","avatar_url":"https://github.com/flyingrobots.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Git-Stargate\n\n\u003cimg alt=\"stargate4\" src=\"https://github.com/user-attachments/assets/a66517db-15ac-465f-8910-e882eacff418\" align=\"right\" width=\"500\" /\u003e\n\nGit-Stargate is a lightweight gateway for Git refs that *aren't* normal branches (e.g., `refs/_blog/*`, `refs/kv/*`, `refs/_shiplog/*`). It enforces fast-forward-only updates, requires signed commits, and can mirror accepted updates to your main remote (GitHub, GitLab, etc.). Perfect for ledger-style content, git-native CMS, and append-only logs.\n\n### Features\n\n- **FF-only**: Rejects non-fast-forward pushes on chosen namespaces.\n- **Signed-only**: Requires `git verify-commit` to pass for new tips.\n- **Mirroring**: Post-receive hook can push accepted refs to an upstream (optionally under `refs/heads/_mirror/...`).\n- **Namespace-targeted**: Default `refs/_blog/*`, configurable.\n- **Tiny footprint**: Bash hooks; no daemon needed. Works with bare repos over SSH.\n\n## Quick start\n```bash\n# In your bare gateway repo (or let bootstrap create it)\n./scripts/bootstrap.sh /srv/git/stargate.git\n# Optionally set upstream for mirroring\nGIT_DIR=/srv/git/stargate.git git remote add origin git@github.com:you/yourrepo.git\n```\n\n## CLI (planned)\n- `git stargate init /path/to/bare`\n- `git stargate set-origin \u003curl\u003e`\n- `git stargate ns add refs/_blog/*`\n\n## Config (planned)\n- Env or `.stargate/config` for namespaces, mirroring target, signed-only toggle, heads-mirroring flag.\n\n## Hooks\n- `pre-receive`: FF-only + signed-only for configured namespaces.\n- `post-receive`: Mirrors accepted refs to upstream.\n\n## Why not GitHub branch protection?\nBranch protection only covers `refs/heads/*`. If your ledger lives under custom refs, Git-Stargate enforces policy before anything hits GitHub. When GitHub visibility is needed, mirror to `refs/heads/_blog/*`.\n\n## Roadmap\n- Small Go CLI for nicer UX.\n- Tests for hooks (bats or Go integration).\n- Configurable namespace list and mirror mappings.\n- Optional heads-mirroring switch.\n\n## License\n[MIT](./LICENSE)\n_© James Ross • [flyingrobots](http://github.com/flyingrobots)_\n\n\n## Sequence: push path with stargate\n\n```mermaid\nsequenceDiagram\n    participant Dev as Dev workstation\n    participant SG as Stargate (bare repo)\n    participant GH as GitHub (mirror)\n\n    Dev-\u003e\u003eSG: git push stargate refs/_blog/articles/\u003cslug\u003e\n    SG--\u003e\u003eSG: pre-receive: FF check + verify-commit\n    alt passes policy\n        SG--\u003e\u003eGH: post-receive mirror refs/_blog/* (or heads/_blog/*)\n        GH--\u003e\u003eDev: mirror ack (non-blocking)\n        SG--\u003e\u003eDev: push success\n    else fails policy\n        SG--\u003e\u003eDev: reject push (non-FF or unsigned)\n    end\n```\n\n## Sequence: publish (fast-forward only)\n\n```mermaid\nsequenceDiagram\n    participant Dev as Dev\n    participant SG as Stargate\n    participant GH as GitHub\n\n    Dev-\u003e\u003eDev: update refs/_blog/published/\u003cslug\u003e (FF in local repo)\n    Dev-\u003e\u003eSG: git push stargate refs/_blog/published/\u003cslug\u003e\n    SG--\u003e\u003eSG: pre-receive policy (FF + signed)\n    SG--\u003e\u003eGH: mirror published ref\n    GH--\u003e\u003eCI: build hook fetches published refs\n    CI--\u003e\u003eSite: rebuild static JSON (writing.json)\n```\n\n## Why this exists\n- Enforce FF-only and signed commits on non-branch namespaces (`refs/_blog/*`, `refs/kv/*`, etc.).\n- Provide a tiny gateway that mirrors accepted refs to GitHub while rejecting bad pushes early.\n- Keep custom ledgers (commit-message articles, KV, shiplog) safe from force pushes and unsigned writes.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fflyingrobots%2Fgit-stargate","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fflyingrobots%2Fgit-stargate","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fflyingrobots%2Fgit-stargate/lists"}