CodeIssuesDiscussionsWikiPull RequestsProjectsCommitsActionsReleasesContributorsPulse● GatesSecuritySettingsDeploymentsPipelineInsightsAgents✨ Explain✨ Ask AI✨ Workspace✨ Spec✨ Tests▓ Debt Map✨ NL Search🏛 Archaeology
Blame · Line-by-line history
README.md
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| 06d5ffe | 1 | # gluecron |
| 2 | ||
| 90fa787 | 3 | A GitHub replacement. AI-native code intelligence, git hosting, automated CI, and a self-hostable platform built to keep every push production-ready. Every repo ships with gates, branch protection, CODEOWNERS sync, and an AI reviewer on by default — opt out per feature, never by default. Deploy anywhere Bun runs — fly.toml is in-repo, Dockerfile for any container host. Backed by Neon Postgres. |
| 06d5ffe | 4 | |
| 988380a | 5 | ## Features |
| 6 | ||
| 7 | ### Code hosting | |
| 8 | - Git Smart HTTP (clone / push / fetch) — subprocess-backed | |
| 9 | - SSH keys, personal access tokens, OAuth 2.0 provider | |
| 10 | - Public / private repos, forks, stars, topics, archive, transfer, template repos | |
| 11 | - Pull-style repository mirroring (upstream git URL, periodic fetch + audit log) | |
| 12 | - Releases, tags, protected tags | |
| 13 | - Repository rulesets — push policy engine covering commit/branch/tag patterns, blocked paths, file-size caps, force-push forbiddance | |
| 14 | ||
| 15 | ### Code browsing | |
| 16 | - File tree, syntax highlighting (40+ languages), commit log, unified diffs, blame, raw | |
| 17 | - Branch + tag switcher, contributor list, commit activity graph | |
| 18 | - Code search (ILIKE) — per-repo and global | |
| 19 | - Semantic code search — Voyage `voyage-code-3` when `VOYAGE_API_KEY` is set, deterministic hashing fallback otherwise | |
| 20 | - Symbol / xref navigation across ts/js/py/rs/go/rb/java/kt/swift | |
| 21 | - Dependency graph — npm / pip / poetry / go / cargo / rubygems / composer | |
| 22 | - Commit signature verification — GPG + SSH "Verified" badges | |
| 23 | ||
| 24 | ### Collaboration | |
| 25 | - Issues, labels, milestones, issue templates, saved replies | |
| 26 | - Pull requests: inline review, draft PRs, AI triage on create, merge queues, required-checks matrix | |
| 27 | - Discussions (forum threads, q-and-a, pinned/locked) | |
| 28 | - Wikis (DB-backed, revision history + revert) | |
| 29 | - Projects / kanban boards | |
| 30 | - Gists (multi-file, per-revision snapshots, stars, secret) | |
| 31 | - Reactions (8 canonical emoji) on issues, PRs, and comments | |
| 32 | - Mentions, notifications, personalised activity feed, user follows, profile READMEs | |
| 33 | - Closing keywords auto-close issues on PR merge | |
| 34 | ||
| 35 | ### AI-native | |
| 36 | - AI code review blocks merges on fail (`requireAiApproval` branch protection) | |
| 37 | - AI security review (Sonnet 4) + 15-pattern secret scanner on every push | |
| 38 | - AI commit messages, PR summaries, changelogs (per-range viewer + on release) | |
| 39 | - AI merge-conflict resolver, AI incident responder (auto-issue on deploy fail) | |
| 40 | - AI explain-this-codebase (per-commit cached Markdown) | |
| 41 | - AI-generated failing test stubs | |
| 42 | - AI dependency updater (opens a PR with a bump table) | |
| 43 | - Copilot-style completion endpoint (`POST /api/copilot/completions`, Haiku, LRU-cached) | |
| 44 | - AI chat — global and repo-scoped | |
| 45 | ||
| 46 | ### Automation | |
| 47 | - Workflow runner — `.gluecron/workflows/*.yml` auto-discovered on push, Bun subprocess executor, per-step timeouts, size-capped logs | |
| 48 | - Outbound webhooks (HMAC-signed) on push / issue / PR / star | |
| 49 | - Inbound GateTest callback (bearer or HMAC) | |
| 50 | - Commit status API — external CI POSTs per-commit statuses, combined rollup | |
| 51 | - Auto-repair engine (rewrites broken commits when `ANTHROPIC_API_KEY` is set) | |
| 52 | - Autopilot background ticker — mirror sync, merge-queue processing, weekly email digests, advisory rescans (opt out via `AUTOPILOT_DISABLED=1`) | |
| 53 | - Dependabot-equivalent dep bumper + security advisories scanner | |
| 54 | - CODEOWNERS auto-sync with team-based resolution (`@org/team`) | |
| 55 | ||
| 56 | ### Platform | |
| 57 | - Organizations + teams (owner / admin / member roles, team-based CODEOWNERS) | |
| 58 | - 2FA / TOTP with recovery codes | |
| 59 | - WebAuthn / passkeys | |
| 60 | - Enterprise SSO via OIDC (Okta, Azure AD, Auth0, Google Workspace) | |
| 61 | - App marketplace + GitHub-Apps-equivalent bot identities (`ghi_` install tokens, scoped permissions) | |
| 62 | - Package registry (npm protocol — packument / tarball / publish / yank) | |
| 63 | - Pages / static hosting (serves from `gh-pages` branch) | |
| 64 | - Environments with protected approvals (reviewer-gated deploys, branch-glob restrictions) | |
| 65 | - Sponsors (tier management — payment rails deferred) | |
| 66 | - Personal dashboard, explore, global search, insights, releases | |
| 67 | - REST + GraphQL APIs (queries only on GraphQL) | |
| 68 | - Official CLI (`cli/gluecron.ts`) — single-file Bun binary | |
| 69 | - VS Code extension (`vscode-extension/`) — explain / open-on-web / semantic search / test generation | |
| 70 | - Mobile PWA (manifest + offline-capable service worker). Native iOS/Android apps are not built. | |
| 71 | - Command palette (Cmd+K), keyboard shortcuts, dark + light themes | |
| 72 | ||
| 73 | ### Observability | |
| 74 | - Rate limiting, request-ID tracing, `/healthz`, `/readyz`, `/metrics` | |
| 75 | - Audit log (personal + per-repo) | |
| 76 | - Traffic analytics per repo (views + clones, 7/14/30/90d windows, SHA-truncated IP uniqueness) | |
| 77 | - Org-wide insights dashboard (green rate, PR/issue counts, per-repo breakdown) | |
| 78 | - Site admin panel — user management, system flags (`registration_locked`, `site_banner_*`, `read_only_mode`), billing overrides | |
| 79 | - Billing + quotas (free / pro / team / enterprise seeded plans) | |
| 80 | - Email notifications (provider-pluggable: log default, Resend in prod) + opt-in weekly digest | |
| 81 | ||
| 82 | For the full shipped-vs-missing scorecard and internal roadmap, see [`BUILD_BIBLE.md`](./BUILD_BIBLE.md). | |
| 83 | ||
| 84 | ## Quick start | |
| 06d5ffe | 85 | |
| 86 | ```bash | |
| 87 | bun install | |
| 988380a | 88 | bun dev # hot-reload dev server |
| 89 | bun run db:migrate # run database migrations | |
| 90 | bun test # run the test suite | |
| 06d5ffe | 91 | ``` |
| 92 | ||
| 93 | Then visit `http://localhost:3000` to register and create your first repository. | |
| 94 | ||
| 988380a | 95 | You'll need at minimum a `DATABASE_URL` pointing at Postgres. Everything AI-flavoured gracefully degrades without `ANTHROPIC_API_KEY`. See [`.env.example`](./.env.example) for the full list. |
| 06d5ffe | 96 | |
| 97 | ## Stack | |
| 98 | ||
| 988380a | 99 | - **Runtime:** Bun |
| 100 | - **Framework:** Hono (with JSX for server-rendered views) | |
| 101 | - **Database:** Drizzle ORM + Neon (PostgreSQL) | |
| 102 | - **Git:** Smart HTTP protocol via git CLI subprocesses | |
| 103 | ||
| 104 | ## Architecture (top-level) | |
| 105 | ||
| 106 | ``` | |
| 107 | src/ | |
| 108 | index.ts Bun server entry | |
| 109 | app.tsx Hono composition + error handlers | |
| 110 | db/ Drizzle schema + lazy connection + migrations | |
| 111 | git/ repository.ts (tree/blob/commits/diff/blame/...) + protocol.ts | |
| 90fa787 | 112 | hooks/ post-receive (GateTest, outbound deploy webhook, webhooks, CODEOWNERS) |
| 988380a | 113 | lib/ auth, config, markdown, highlight, AI helpers, autopilot, ... |
| 114 | middleware/ softAuth / requireAuth / rate-limit / request-context | |
| 115 | routes/ git, api, web, issues, pulls, editor, settings, webhooks, ... | |
| 116 | views/ layout, components, landing, reactions | |
| 117 | ``` | |
| 118 | ||
| 119 | Full file inventory lives in [`CLAUDE.md`](./CLAUDE.md). | |
| 120 | ||
| 90fa787 | 121 | ## Integrations |
| 988380a | 122 | |
| 90fa787 | 123 | - **GateTest** — optional third-party security scanner. When `GATETEST_URL` is set, every `git push` POSTs to it; inbound results accepted at `POST /api/hooks/gatetest` (bearer or HMAC). |
| 988380a | 124 | - **Webhooks** — user-registered URLs receive HMAC-signed payloads on push / issue / PR / star events. |
| 90fa787 | 125 | - **Outbound deploy webhook** — optional. Set `CRONTECH_DEPLOY_URL` (or any URL) to receive a POST on pushes to the default branch. Opt out per repo via `autoDeployEnabled`. |
| 988380a | 126 | |
| 127 | ## Deployment | |
| 128 | ||
| 90fa787 | 129 | Gluecron runs anywhere Bun runs. The repo ships a `fly.toml` for Fly.io and a `Dockerfile` for any container host, with Neon Postgres as the database. See [`DEPLOY.md`](./DEPLOY.md) for step-by-step instructions, environment variables, and the post-deploy verification checklist. |
| 988380a | 130 | |
| 131 | ## License | |
| 132 | ||
| 133 | See [`LICENSE`](./LICENSE). |