gitfor roadmap

This roadmap covers every feature gitfor still lacks compared to GitHub Free/Pro.

The following are deliberately out of scope: SSH transport (Containers are too expensive to keep warm as an SSH frontend), tag protection, saved replies, the Actions Marketplace / third-party uses: actions, package and container registries, Dependabot, and user blocking.

Every feature should lean on Cloudflare primitives first: Workers, D1, KV, R2, Queues, Workflows, Durable Objects, Email Service, Rate Limiting, Analytics Engine, Secrets Store, Images, Cron Triggers and Cloudflare for SaaS. Containers are a last resort because they are the most expensive primitive.

Ground rules for every workstream

• Work on your own branch in your own git worktree; never push.
• Keep changes additive: prefer new files, and keep edits to shared files (wrangler.jsonc, src/routes/$owner.$repo.tsx, src/components/SiteHeader.tsx, src/server.ts, src/lib/types.ts) small and localized so branches merge cleanly.
• New D1 migrations must use the number range assigned to your workstream (for example migrations/0310_lfs.sql) so files never collide.
• Run bun run cf-typegen after editing wrangler.jsonc, and keep bunx tsc --noEmit -p ., bun run lint, bun run knip, bun run format:check and bunx vite build green before each commit.
• Server-only code lives in src/server/**; src/fns/** files may only export createServerFn values (anything else leaks server modules into the client bundle).
• Respect the DoS rules in src/server/limits.ts: rate-limit writes and heavy reads, cap fan-out and counts, bound every loop over git objects, and keep D1 IN-lists under MAX_IN_LIST.
• Commit early and often with descriptive messages.

Workstreams

1. Code intelligence — migrations 0100–0199

• Blame: walk first-parent history per file with tree/blob reads, attribute lines with an incremental diff, cache results in KV keyed by (blob, commit), and bound the walk.
• Per-path history: commit log filtered by path (/commits/<ref>/<path>), computed by comparing tree entries along the history and cached in KV.
• Last commit per tree entry: computed lazily per directory and cached in KV.
• Go to file: a fuzzy file finder over the cached recursive tree listing.
• Code search: a Queue consumer indexes text blobs of the default branch on push into D1 FTS5 (code_fts), bounded per push, with deletes on file removal. Search UI scoped per repo and globally (visibility-aware).
• Rich rendering: Jupyter notebooks, CSV/TSV tables, SVG previews (sandboxed <img>), and image diffs (side-by-side / swipe) in commit and PR views.

2. Git LFS — migrations 0200–0299

• An LFS Batch API (/<owner>/<repo>.git/info/lfs/objects/batch) implemented in the Worker, authenticated by personal access tokens.
• Objects stored in R2 under lfs/<repoId>/<oid>, uploaded and downloaded through presigned R2 URLs or Worker-streamed transfers, with SHA-256 verification.
• The LFS locking API (/locks, /locks/verify, /locks/:id/unlock) backed by D1.
• Per-owner storage and bandwidth quotas tracked in D1 and enforced on upload.
• UI: detect LFS pointer files in tree/blob views and serve the real content from R2 in blob, raw and archive routes.

3. Identity and account security — migrations 0300–0399

• Email via the Cloudflare Email Service send_email binding: email verification on signup and email change, password reset, and email notifications rendered from templates and sent through a Queue.
• Two-factor auth: TOTP (WebCrypto HMAC) with recovery codes, plus passkeys (WebAuthn registration and assertion verified in the Worker) usable for 2FA or passwordless login.
• Fine-grained tokens: tokens scoped to selected repos and permissions (contents read/write, issues, pulls, actions, admin) and enforced in the git proxy, raw routes and API.
• Deploy tokens: repo-scoped read or write tokens (the HTTPS replacement for SSH deploy keys).
• Notification settings: per-user email/web preferences, per-thread subscribe/unsubscribe, custom watch levels (all, participating, releases only, ignore).
• Profiles: avatar uploads to R2 served through Cloudflare Images transforms, profile README (<user>/<user> repo), contribution graph from activity, follow/followers.
• Account rename with redirects for old URLs (D1 redirect table), and repository transfer between owners with redirects.

4. Organizations, API and administration — migrations 0400–0499

• Teams inside organizations with per-repo permissions, nested teams, team mentions (@org/team), team review requests, and the default org member permission as an org setting.
• REST API at /api/v3, a GitHub-compatible subset (repos, contents, commits, branches, issues, comments, pulls, reviews, releases, actions runs, webhooks), authenticated with tokens and rate-limited.
• OAuth apps and app installations: OAuth authorization-code flow, installable apps with per-repo grants, short-lived installation tokens, and webhook delivery to apps.
• Audit log for orgs and site admins, written through a Queue and retained in D1 with R2 archival.
• Site admin dashboard: users, repos, quotas, runners, queue health, suspend users.
• Moderation: report content (issues, comments, repos) to repo admins or site admins, hide or minimize comments, and lock threads with a reason.

5. Pull requests and code review — migrations 0500–0599

• Suggested changes in review comments, with a "Commit suggestion" (single and batched) applied through the in-Worker git writer.
• Multi-line review comments (start/end line ranges).
• Update branch: merge the base into the head with an in-Worker tree merge for conflict-free cases, falling back to the existing git container only when needed.
• Web conflict resolution: show conflicted files and let users edit conflict markers, committing a merge commit through the Worker writer.
• Auto-merge when requirements are met, driven by the push and CI completion events.
• Merge queue: a per-branch Durable Object that serializes merges, builds speculative merge commits, runs required checks and lands them in order.
• CODEOWNERS: parse CODEOWNERS, auto-request owners as reviewers, and add a "require code owner review" protection option.
• Re-request review, dismiss review with a reason, review a subset of commits ("changes since last review").
• PR templates and a linked-issues ("Development") sidebar, including manual linking.

6. Issues, planning and discussions — migrations 0600–0699

• Milestones with progress, issue types, sub-issues with progress, pinned issues, and transferring issues between repos.
• Projects: table and board views over issues and PRs with custom fields, plus live collaboration via a Durable Object per project.
• Reactions on issues, PRs, comments and review comments.
• Discussions: categories, threaded answers, marking answers, upvotes, converting issues to discussions.
• Attachments: drag-and-drop uploads in every markdown editor, stored in R2 with size/type limits and per-owner quotas, served through Images transforms for images.
• Issue templates and issue forms (.gitfor/ISSUE_TEMPLATE/*.yml), plus a config.yml chooser.
• Rich mentions and references: owner/repo#123, commit SHAs, @org/team, with hovercards.

7. Actions and CI — migrations 0700–0799

• Scheduled workflows: index on.schedule crons into D1 on push to the default branch, and fire them from the existing Cron Trigger.
• Additional triggers: issues, issue_comment, pull_request_review, workflow_run, release types, create/delete.
• Job outputs ($GITFOR_OUTPUT) and a needs.<job>.outputs expression context; step outputs (steps.<id>.outputs).
• Cache: a built-in actions/cache-compatible step backed by R2 with per-repo quotas and LRU eviction.
• Variables (vars context) and org-level secrets and variables with repo access policies.
• Environments: protection rules, required reviewers (Workflows waitForEvent), wait timers, environment secrets, and a deployments UI.
• OIDC tokens: per-job JWTs signed with a key from Secrets Store, plus a JWKS endpoint.
• Job token: a short-lived, job-scoped token (the GITHUB_TOKEN equivalent) for the REST API and git, with configurable permissions.
• Status badges (SVG endpoint), re-running only failed jobs, and larger runner sizes selected by runs-on labels mapped to Container instance types.

8. Pages — migrations 0800–0899

• Static site hosting from a branch/folder or from a workflow artifact, deployed into R2 under content-addressed prefixes.
• Served by the Worker on <owner>.<pages-domain>/<repo> and on custom domains through Cloudflare for SaaS custom hostnames.
• Deploy history, rollbacks, preview deployments per pull request, and 404.html/SPA fallback support.

9. Security features — migrations 0900–0999

• SECURITY.md surfacing and a security tab.
• Private vulnerability reporting and repository security advisories with private collaboration threads.
• Secret scanning in the push workflow (regex detectors for common token formats, with alerts and push protection on the proxy).
• Code scanning: a SARIF upload API and an alerts UI with PR annotations.
• Dependency graph: parse common manifests and lockfiles on push and show a dependencies view (no automated update PRs).
• Commit signature verification: fetch raw commit objects via upload-pack, verify SSH and GPG signatures against user-registered signing keys, and show "Verified" badges.

10. Platform quality, UX and insights — migrations 1000–1099

• A test suite with @cloudflare/vitest-pool-workers (unit tests for git objects, protocol, diff, CI compiler, permissions; integration tests for server functions against Miniflare D1/KV/R2).
• Live updates: a Durable Object per repo broadcasting issue, PR and run changes over WebSockets to open pages.
• Keyboard shortcuts and a command palette, a mobile-responsive layout, and a light theme with a theme toggle.
• Insights: traffic (views and clones) via Analytics Engine, contributors, commit activity, code frequency and pulse.
• Mirroring and scheduled imports: pull mirrors refreshed from Cron Triggers using Artifacts import, and push mirrors to external remotes.
• Repository templates: "Use this template" via Artifacts fork with history squashed.