# gitfor roadmap This roadmap covers every feature gitfor still lacks compared to GitHub Free/Pro. The following are deliberately **out of scope**: SSH transport (Containers are too expensive to keep warm as an SSH frontend), tag protection, saved replies, the Actions Marketplace / third-party `uses:` actions, package and container registries, Dependabot, and user blocking. Every feature should lean on Cloudflare primitives first: Workers, D1, KV, R2, Queues, Workflows, Durable Objects, Email Service, Rate Limiting, Analytics Engine, Secrets Store, Images, Cron Triggers and Cloudflare for SaaS. Containers are a last resort because they are the most expensive primitive. ## Ground rules for every workstream - Work on your own branch in your own git worktree; never push. - Keep changes additive: prefer new files, and keep edits to shared files (`wrangler.jsonc`, `src/routes/$owner.$repo.tsx`, `src/components/SiteHeader.tsx`, `src/server.ts`, `src/lib/types.ts`) small and localized so branches merge cleanly. - Migrations were squashed into one file per area (`migrations/0001_core.sql` ... `0017_platform.sql`); add new changes as the next sequential file. - Run `bun run cf-typegen` after editing `wrangler.jsonc`, and keep `bunx tsc --noEmit -p .`, `bun run lint`, `bun run knip`, `bun run format:check` and `bunx vite build` green before each commit. - Server-only code lives in `src/server/**`; `src/fns/**` files may only export `createServerFn` values (anything else leaks server modules into the client bundle). - Respect the DoS rules in `src/server/limits.ts`: rate-limit writes and heavy reads, cap fan-out and counts, bound every loop over git objects, and keep D1 IN-lists under `MAX_IN_LIST`. - Commit early and often with descriptive messages. ## Workstreams ### 1. Code intelligence — migrations `0100`–`0199` - **Blame**: walk first-parent history per file with tree/blob reads, attribute lines with an incremental diff, cache results in KV keyed by `(blob, commit)`, and bound the walk. - **Per-path history**: commit log filtered by path (`/commits//`), computed by comparing tree entries along the history and cached in KV. - **Last commit per tree entry**: computed lazily per directory and cached in KV. - **Go to file**: a fuzzy file finder over the cached recursive tree listing. - **Code search**: a Queue consumer indexes text blobs of the default branch on push into D1 FTS5 (`code_fts`), bounded per push, with deletes on file removal. Search UI scoped per repo and globally (visibility-aware). - **Rich rendering**: Jupyter notebooks, CSV/TSV tables, SVG previews (sandboxed ``), and image diffs (side-by-side / swipe) in commit and PR views. ### 2. Git LFS — migrations `0200`–`0299` - An LFS Batch API (`//.git/info/lfs/objects/batch`) implemented in the Worker, authenticated by personal access tokens. - Objects stored in R2 under `lfs//`, uploaded and downloaded through presigned R2 URLs or Worker-streamed transfers, with SHA-256 verification. - The LFS locking API (`/locks`, `/locks/verify`, `/locks/:id/unlock`) backed by D1. - Per-owner storage and bandwidth quotas tracked in D1 and enforced on upload. - UI: detect LFS pointer files in tree/blob views and serve the real content from R2 in blob, raw and archive routes. ### 3. Identity and account security — migrations `0300`–`0399` - **Email** via the Cloudflare Email Service `send_email` binding: email verification on signup and email change, password reset, and email notifications rendered from templates and sent through a Queue. - **Two-factor auth**: TOTP (WebCrypto HMAC) with recovery codes, plus **passkeys** (WebAuthn registration and assertion verified in the Worker) usable for 2FA or passwordless login. - **Fine-grained tokens**: tokens scoped to selected repos and permissions (contents read/write, issues, pulls, actions, admin) and enforced in the git proxy, raw routes and API. - **Deploy tokens**: repo-scoped read or write tokens (the HTTPS replacement for SSH deploy keys). - **Notification settings**: per-user email/web preferences, per-thread subscribe/unsubscribe, custom watch levels (all, participating, releases only, ignore). - **Profiles**: avatar uploads to R2 served through Cloudflare Images transforms, profile README (`/` repo), contribution graph from activity, follow/followers. - **Account rename** with redirects for old URLs (D1 redirect table), and **repository transfer** between owners with redirects. ### 4. Organizations, API and administration — migrations `0400`–`0499` - **Teams** inside organizations with per-repo permissions, nested teams, team mentions (`@org/team`), team review requests, and the default org member permission as an org setting. - **REST API** at `/api/v3`, a GitHub-compatible subset (repos, contents, commits, branches, issues, comments, pulls, reviews, releases, actions runs, webhooks), authenticated with tokens and rate-limited. - **OAuth apps and app installations**: OAuth authorization-code flow, installable apps with per-repo grants, short-lived installation tokens, and webhook delivery to apps. - **Audit log** for orgs and site admins, written through a Queue and retained in D1 with R2 archival. - **Site admin dashboard**: users, repos, quotas, runners, queue health, suspend users. - **Moderation**: report content (issues, comments, repos) to repo admins or site admins, hide or minimize comments, and lock threads with a reason. ### 5. Pull requests and code review — migrations `0500`–`0599` - **Suggested changes** in review comments, with a "Commit suggestion" (single and batched) applied through the in-Worker git writer. - **Multi-line review comments** (start/end line ranges). - **Update branch**: merge the base into the head with an in-Worker tree merge for conflict-free cases, falling back to the existing git container only when needed. - **Web conflict resolution**: show conflicted files and let users edit conflict markers, committing a merge commit through the Worker writer. - **Auto-merge** when requirements are met, driven by the push and CI completion events. - **Merge queue**: a per-branch Durable Object that serializes merges, builds speculative merge commits, runs required checks and lands them in order. - **CODEOWNERS**: parse `CODEOWNERS`, auto-request owners as reviewers, and add a "require code owner review" protection option. - Re-request review, dismiss review with a reason, review a subset of commits ("changes since last review"). - PR templates and a linked-issues ("Development") sidebar, including manual linking. ### 6. Issues, planning and discussions — migrations `0600`–`0699` - Milestones with progress, issue types, sub-issues with progress, pinned issues, and transferring issues between repos. - **Projects**: table and board views over issues and PRs with custom fields, plus live collaboration via a Durable Object per project. - **Reactions** on issues, PRs, comments and review comments. - **Discussions**: categories, threaded answers, marking answers, upvotes, converting issues to discussions. - **Attachments**: drag-and-drop uploads in every markdown editor, stored in R2 with size/type limits and per-owner quotas, served through Images transforms for images. - **Issue templates and issue forms** (`.gitfor/ISSUE_TEMPLATE/*.yml`), plus a `config.yml` chooser. - **Rich mentions and references**: `owner/repo#123`, commit SHAs, `@org/team`, with hovercards. ### 7. Actions and CI — migrations `0700`–`0799` - **Scheduled workflows**: index `on.schedule` crons into D1 on push to the default branch, and fire them from the existing Cron Trigger. - Additional triggers: `issues`, `issue_comment`, `pull_request_review`, `workflow_run`, `release` types, `create`/`delete`. - **Job outputs** (`$GITFOR_OUTPUT`) and a `needs..outputs` expression context; step outputs (`steps..outputs`). - **Cache**: a built-in `actions/cache`-compatible step backed by R2 with per-repo quotas and LRU eviction. - **Variables** (`vars` context) and org-level secrets and variables with repo access policies. - **Environments**: protection rules, required reviewers (Workflows `waitForEvent`), wait timers, environment secrets, and a deployments UI. - **OIDC tokens**: per-job JWTs signed with a key from Secrets Store, plus a JWKS endpoint. - **Job token**: a short-lived, job-scoped token (the `GITHUB_TOKEN` equivalent) for the REST API and git, with configurable permissions. - Status badges (SVG endpoint), re-running only failed jobs, and larger runner sizes selected by `runs-on` labels mapped to Container instance types. ### 8. Pages — migrations `0800`–`0899` (removed; replaced by Sites, docs/sites-design.md) - Static site hosting from a branch/folder or from a workflow artifact, deployed into R2 under content-addressed prefixes. - Served by the Worker on `./` and on custom domains through Cloudflare for SaaS custom hostnames. - Deploy history, rollbacks, preview deployments per pull request, and `404.html`/SPA fallback support. ### 9. Security features — migrations `0900`–`0999` - `SECURITY.md` surfacing and a security tab. - **Private vulnerability reporting and repository security advisories** with private collaboration threads. - **Secret scanning** in the push workflow (regex detectors for common token formats, with alerts and push protection on the proxy). - **Code scanning**: a SARIF upload API and an alerts UI with PR annotations. - **Dependency graph**: parse common manifests and lockfiles on push and show a dependencies view (no automated update PRs). - **Commit signature verification**: fetch raw commit objects via upload-pack, verify SSH and GPG signatures against user-registered signing keys, and show "Verified" badges. ### 10. Platform quality, UX and insights — migrations `1000`–`1099` - A test suite with `@cloudflare/vitest-pool-workers` (unit tests for git objects, protocol, diff, CI compiler, permissions; integration tests for server functions against Miniflare D1/KV/R2). - **Live updates**: a Durable Object per repo broadcasting issue, PR and run changes over WebSockets to open pages. - Keyboard shortcuts and a command palette, a mobile-responsive layout, and a light theme with a theme toggle. - **Insights**: traffic (views and clones) via Analytics Engine, contributors, commit activity, code frequency and pulse. - **Repository templates**: "Use this template" via Artifacts fork with history squashed.