Deploy with git push

​

Turn it on

1. Open Settings, Beta features and switch on Git push deploy (or add git-push to APP_EXPERIMENTAL). It applies at once, no restart.
2. Create the app first. An empty app made with levelrail-cli apps create or the dashboard is enough.
3. Enable the remote for that app, from the CLI or the app’s Source tab.

levelrail-cli git remote add my-app

git remote add levelrail https://git:gp_...@cp.example.com/api/v1/git/my-app.git
git push levelrail main

​

What a push does

remote: Received commit 3f2a9c1 on main, starting the build.
remote: ...build output...
remote: Deploy succeeded: 3f2a9c1 is rolling out.

• The image is tagged by the pushed commit, and the deploy shows in the app’s deploy history with the commit, message and author. Rollback works as for any other deploy.
• If the build fails, git shows [remote rejected] ... deploy failed, the previous release keeps running, and the branch on the server does not move. After fixing the build, run the same git push again.
• A Dockerfile at the repository root is built as a Dockerfile, anything else with Railpack. If the app has a connected git source its build settings are used instead.
• One deploy per app at a time. A push during a running deploy or a deploy freeze is refused with a message.

levelrail-cli git remote branch my-app release

​

Tokens

• One token per app, shown once, stored only as a SHA-256 hash.
• The token can do one thing: push to that app. It cannot read the app, list anything or call the API.
• levelrail-cli git remote rotate my-app issues a new token and the old one stops working at once. revoke turns the remote off.
• Wrong or missing tokens always answer the same way, requests are rate limited, and repeated bad tokens back off. Every push outcome is written to the audit log.
• Creating, rotating, changing the branch and revoking need the write_sensitive ability on the app.

​

Limits

• It is not a git host. There is no repository browser, history view or pull request, and git clone and git fetch are refused.
• No Git LFS, no SSH, no Compose apps, no per-branch environments.
• Anyone with the token can deploy that app. Treat it like a deploy key, rotate it when someone leaves.
• It needs the source cache directory, which every normal install has. Without it the endpoints answer 501.
• The control plane must be reachable over HTTPS from where you push. Over plain HTTP the token travels in clear text, so use the HTTPS dashboard address.

​

Troubleshooting