AbsoluteJS

Git

@absolutejs/gitv0.5.1betaData & Sync

Provider-neutral authenticated Git source ingestion, webhook normalization, exact-revision materialization, and provenance for Bun and AbsoluteJS.

#Installation

BASH
bun add @absolutejs/git

#Capabilities

Overview

Authenticated Git source ingestion for Bun control planes and AbsoluteJS.

The package turns a signed provider webhook into a normalized, authorized exact revision, checks that revision out without a shell, strips Git metadata, applies source-size and file-count limits, and emits portable provenance. It does not own credentials, databases, queues, build sandboxes, deployment, or UI. GitHub App installations can also create and update normalized Check Runs so a control plane reports exact-revision deployment posture without hand-writing provider payloads.

Security boundary

Verify signatures against the untouched request bytes before parsing JSON.

Derive canonical provider URLs instead of trusting webhook clone URLs.

Authorize both repository identity and full ref before checkout.

Show 8 more

Fetch and verify the exact commit, never a moving branch tip.

Pass Git arguments as an array; credentials use child-process environment

configuration and are never embedded in repository URLs or errors.

Remove .git, reject links and special files, and enforce source bounds before

handing a tree to a build system.

Run installation and builds in a separate sandbox with network, CPU, memory,

time, and output limits. That policy belongs to the host control plane.

@absolutejs/deploy/release-artifact remains the ecosystem owner of immutable deployment archives and their SHA-256 integrity contract.

Outcomes

What you can build

Overview

Authenticated Git source ingestion for Bun control planes and AbsoluteJS.

Security boundary

Verify signatures against the untouched request bytes before parsing JSON.

Hardening checklist

Production guidance

Security boundaryVerify signatures against the untouched request bytes before parsing JSON.

Follow in order

Troubleshooting path

1
Security boundary
Verify signatures against the untouched request bytes before parsing JSON.

#@absolutejs/git quick start

Partial snippet

# @absolutejs/git

TS
import { assertGitRevisionAuthorized, gitProvenanceFor } from "@absolutejs/git";
import { createGitCheckout } from "@absolutejs/git/checkout";
import { verifyGitHubPushWebhook } from "@absolutejs/git/github";

const event = verifyGitHubPushWebhook({
  body: rawBody,
  headers: request.headers,
  secret: webhookSecret,
});

assertGitRevisionAuthorized(
  {
    allowedRefs: ["refs/heads/main"],
    repository: { provider: "github", fullName: "acme/site" },
  },
  event.revision,
);

const checkout = await createGitCheckout({
  credential: { token: installationToken },
  revision: event.revision,
});
try {
  await isolatedBuild(checkout.sourceRoot, gitProvenanceFor(event));
} finally {
  await checkout.dispose();
}

#Public entry points

Supported entry points declared by this project’s package manifest. Internal dist paths are not part of the package contract.

Public package entry point declared in package.json.

@absolutejs/git@absolutejs/git/github@absolutejs/git/github-app@absolutejs/git/github-app-user@absolutejs/git/checkout@absolutejs/git/manifest@absolutejs/git/manifest.json

#Package commands

Scripts declared by this project’s package manifest.

bun run buildrm -rf dist && bun build src/index.ts src/github.ts src/github-app.ts src/github-app-user.ts src/checkout.ts src/manifest.ts --outdir dist --sourcemap --target=bun --external @absolutejs/manifest --external @sinclair/typebox --external @sinclair/typebox/value && tsc --project tsconfig.build.json && absolute-manifest emit
bun run check:packagebun run typecheck && bun run build && bun run test
bun run formatprettier --write "./**/*.{ts,json,md}"
bun run testbun test tests/
bun run typechecktsc --noEmit

#API reference

Search the declarations exported by the current package type files. Expand a symbol to inspect its source-backed signature.

20 symbols
GitRepositorySchemavaluePermalink
TS
const GitRepositorySchema: import("@sinclair/typebox").TObject<{
    cloneUrl: import("@sinclair/typebox").TString;
    defaultBranch: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
    fullName: import("@sinclair/typebox").TString;
    provider: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"github">, import("@sinclair/typebox").TLiteral<"gitlab">, import("@sinclair/typebox").TLiteral<"bitbucket">, import("@sinclair/typebox").TLiteral<"generic">]>;
    webUrl: import("@sinclair/typebox").TString;
}>;
Exported from @absolutejs/git