Rebasely Beta: data may be purged
Docs menuHow Rebasely works
View as Markdown

How Rebasely works

Rebasely runs entirely on Cloudflare. Every repository is its own Durable Object, a single writer that holds the repository's refs, so a push lands whole or not at all, close to where you are.

How a push flows through Rebasely1. git sends the push to the Rebasely Worker at the edge. 2. The Worker checks the token and the role and reads the refs from the repository's Durable Object. 3. It hands the pack to a push job, a Durable Object of its own. 4. The push job checks every object and stores the pack in R2. 5. It commits the push with the repository's Durable Object, which moves the refs in one step. 6. The repository sends one event per updated ref, which starts Actions and notifications.git clientgit pushWorkerrebasely.com, at the edgePush jobone Durable Object a pushRepositoryits own Durable ObjectR2packs and objectsEventsActions, email1345 commit: move the refs2 refs and permissions6Every repository has its own Durable Object: one writer, so a push either lands whole or not at all.
A push: the Worker checks it, a push job stores the pack, and the repository's own Durable Object moves the refs.

What happens on a push

  1. The Worker takes the request

    git talks to the Rebasely Worker at the Cloudflare location nearest to you, over HTTPS. The Worker checks your token and your role in the organization, and asks the repository's Durable Object for its refs.

  2. A push job checks the pack

    Each push gets a Durable Object of its own. It reads the pack, checks every object the way git fsck --strict does, scans for leaked Rebasely tokens and private keys, and stores the pack in R2. Large or unusual pushes are verified with real git in a sandbox first.

  3. The repository commits it

    The repository's Durable Object checks the ref updates against protection rules and live branches and moves every ref in one step. Then it reports the result to git and sends one event per updated ref, which starts Actions and notifications.

The pieces

PieceWhat it does
WorkerServes the web pages, the API, MCP and git over HTTPS; checks every request's credential and permissions.
Repository (Durable Object)One per repository: its refs, live branches, sandboxes, pull request state and outbox of events.
Push job (Durable Object)One per push: checks and stores the pack, then commits it with the repository.
R2Packs and objects, and Actions logs, artifacts and caches.
D1Accounts, organizations, tokens and other data that is not a repository's.
Cloudflare SandboxesActions jobs, and the real git that verifies unusual pushes.

Reads

Clones and fetches are served from the repository's packs in R2, through the Worker. A private repository the reader cannot see answers exactly like one that does not exist, for git, the API, MCP and the web pages.